CVE-2019-13517

Published: Sep 6, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified where existing access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an AD domain.

Affected (2)

Products: Bd: Pyxis Enterprise Server, Pyxis Es

2 products

Pyxis Enterprise Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Bd Pyxis Enterprise Server	From 4.4 to 4.12
Bd Pyxis Es	From 1.3.4 to 1.6.1

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://www.us-cert.gov/ics/advisories/icsma-19-248-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsma-19-248-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.