CVE-2019-13337 - CVE House
Back to Database
Status published High CVE-2019-13337

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can...

Vulnerability Description

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13337

Credits & Attribution

No credits recorded in the NVD database.

References

More from weseek

View All →
CVE-2022-1236
Weak Password Requirements in weseek/growi
Medium 4.3
CVE-2021-3852
Authorization Bypass Through User-Controlled Key in weseek/growi
Medium 6.3
CVE-2019-13338
In WESEEK GROWI before 3.5.0, a remote attacker can obtain...
High 7.5

Affected Vendor

Affected Software

growi
Vulnerable Versions:
0

Timeline

Official Publish: July 9th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.