CVE-2019-19127: tribalgroup sits

csirt@kutim:~/threat-intel/cve/CVE-2019-19127

CVSS 8.1 · High EPSS 1,3%

Kerentanan Cleartext Transmission of Sensitive Information pada tribalgroup sits. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This occurs because the Uniface TLS Driver is not enabled by default. This vulnerability allows attackers to gain access to credentials or execute arbitrary SQL queries on the SITS backend as long as they have access to the client executable or can intercept traffic from a user who does.

Rincian

Terbit di NVD: 25 Maret 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-319: Cleartext Transmission of Sensitive Information
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 68,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tribalgroup	sits	Versi vision 9.7.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://packetstormsecurity.com/files/156903/SITS-Vision-9.7.0-Authentication-Bypass.html advisory pihak ketiga · vdb entry
http://seclists.org/fulldisclosure/2020/Mar/26 mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.