CVE-2019-15897

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typically not exposed to external networks).

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/155573/BeeGFS-7.1.3-Privilege-Escalation.htmlMitigation, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Dec/7Mailing List, Mitigation, Third Party Advisory
https://www.hpcsec.com/2019/12/04/cve-2019-15897/Mitigation, Third Party Advisory
http://packetstormsecurity.com/files/155573/BeeGFS-7.1.3-Privilege-Escalation.htmlMitigation, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Dec/7Mailing List, Mitigation, Third Party Advisory
https://www.hpcsec.com/2019/12/04/cve-2019-15897/Mitigation, Third Party Advisory

Timeline

Published: Dec 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158986.1Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.CVE-2019-15908.1A vulnerability in the Transport Layer Security (TLS) certificate validation functionality of Cisco Nexus 9000 Series Application Centric In CVE-2019-159009.8An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was us CVE-2019-159018.8An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext(3) call with flags to change t CVE-2019-159025.6A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141 CVE-2019-159037.5In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutiv CVE-2019-15917.8A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, l CVE-2019-159107.5An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "di CVE-2019-159119.8An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key trans CVE-2019-159127.5An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee CVE-2019-159139.8An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key transport in ZigBee CVE-2019-159147.5An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Attackers can use the ZigBee trust center r