Vulnerability in Tribalgroup Sits\
CVE-2019-19127
An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This occurs because the Uniface TLS Driver is not enabled by default. This vulnerability allows attackers to gain access to credentials or execute arbitrary SQL queries on the SITS backend as long as they have access to the client executable or can intercept traffic from a user who does.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (68.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Tribalgroup Sits\ — versions vision
- Tribalgroup Sits\:vision — versions 9.7.0
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2020/Mar/26 (mailing-list, Mailing List, Third Party Advisory)
- packetstormsecurity.com/files/156903/SITS-Vision-9.7.0-Authentication-Bypass.ht… (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-19127?
- CVE-2019-19127 is a high-severity vulnerability in Tribalgroup Sits\, classified under Cleartext Transmission of Sensitive Information. CVSS score: 8.1/10. Published 2020-03-25.
- How severe is CVE-2019-19127?
- High severity. CVSS v3 base score is 8.1 out of 10.