Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-25313: FlexNet Publisher: Unauthenticated Admin Account Creation

CVE-2019-25313 · published 8 months ago

Summary

A flaw in FlexNet Publisher 11.12.1 allows attackers to create admin accounts without a password, which could lead to unauthorized access to sensitive data. This happens when a user is tricked into submitting a malicious form. To protect your system, update to a fixed version of FlexNet Publisher or use alternative security measures, such as two-factor authentication, to prevent unauthorized access.

Original advisory text

FlexNet Publisher 11.12.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious HTML form to trick authenticated users into submitting a request that creates a new local admin account with a predefined password.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published11 Feb 2026

Updated26 Oct 2026

First seen6 Mar 2026

Sources

CVE-2019-25313 · NVD

Track software like this

Free during beta