{"id":"CVE-2019-17082","aliases":["EUVD-2019-7550","GHSA-5mv2-m792-g4pg"],"status":"published","title":"Missing Authentication for Critical Function vulnerability in OpenText™ AccuRev for LDAP...","description":"Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system\n\nthe vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password.\n\nThis issue affects AccuRev: 2017.1.","severity":{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:I/V:C/RE:M/U:Red","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00469,"percentile":0.40853,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306","CWE-522"],"published":"2024-11-26T19:31:57Z","modified":"2026-06-17T02:23:16Z","products":[{"vendor":"opentext","product":"accurev_for_ldap_integration"},{"vendor":"opentext™","product":"accurev"}],"references":[{"url":"https://support.microfocus.com/kb/kmdoc.php?id=KM03544106"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17082"},{"url":"https://github.com/advisories/GHSA-5mv2-m792-g4pg"}],"sources":{"cve":[{"id":"CVE-2019-17082","description":"Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system\n\nthe vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password.\n\nThis issue affects AccuRev: 2017.1.","status":"published","published":"2024-11-26T19:31:57.665Z","modified":"2024-12-17T15:51:44.734Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:I/V:C/RE:M/U:Red","level":"critical","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7550","description":"Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system\n\nthe vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password.\n\nThis issue affects AccuRev: 2017.1.","status":"published","published":"2024-11-26T19:31:57Z","modified":"2024-12-17T15:51:44Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:I/V:C/RE:M/U:Red","level":"critical"}],"updated_at":"2026-11-03T00:04:35.014369Z"}],"ghsa":[{"id":"GHSA-5mv2-m792-g4pg","title":"Missing Authentication for Critical Function vulnerability in OpenText™ AccuRev for LDAP...","description":"Missing Authentication for Critical Function vulnerability in OpenText™ AccuRev for LDAP Integration allows Authentication Bypass. The vulnerability could allow \n\na valid AccuRev username to gain access to AccuRev source control without knowing the user’s password.\n\nThis issue affects AccuRev for LDAP Integration: 2017.1.","status":"published","published":"2024-11-26T21:32:24Z","modified":"2024-12-17T18:34:51Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:I/V:C/RE:M/U:Red","level":"critical"}],"cwes":["CWE-306","CWE-522"],"updated_at":"2026-11-02T14:59:13.557601Z"}],"nvd":[{"id":"CVE-2019-17082","description":"Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system\n\nthe vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password.\n\nThis issue affects AccuRev: 2017.1.","status":"published","published":"2024-11-26T20:15:19.957Z","modified":"2026-06-17T02:23:16.913Z","cvss":[{"version":"4.0","score":9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:I/V:C/RE:M/U:Red","level":"critical","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:05:49.934131Z"}]}}