cvelist/2019/5xxx/CVE-2019-5644.json

{
    "CVE_data_meta": {
        "ASSIGNER": "cve@rapid7.com",
        "DATE_PUBLIC": "2019-09-10T13:05:00.000Z",
        "ID": "CVE-2019-5644",
        "STATE": "PUBLIC",
        "TITLE": "C4G BLIS Improper Access Control"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Basic Laboratory Information System",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<=",
                                            "version_value": "3.5"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Computing For Good"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "This vulnerability was first discovered privately and reported internally by C4G BLIS team member Aditi Shah in December 2018. Jacob Robles of Rapid7 rediscovered and reported these issues in March of 2019 per Rapid7's vulnerability disclosure policy (https://www.rapid7.com/security/disclosure/)."
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, \"Improper Access Control.\" As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.8"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-284 Improper Access Control"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "https://blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5643-cve-2019-5644-c4g-blis-authentication-and-authorization-vulnerabilities-fixed/",
                "refsource": "MISC",
                "url": "https://blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5643-cve-2019-5644-c4g-blis-authentication-and-authorization-vulnerabilities-fixed/"
            }
        ]
    },
    "solution": [
        {
            "lang": "eng",
            "value": "C4G BLIS users should update to version 3.51 or later."
        }
    ],
    "source": {
        "advisory": "R7-2019-09.3",
        "discovery": "EXTERNAL"
    }
}