CVE-2019-16133

6.5 mediumEPSS 1.0%

Medium (6.5) in weaver eteams oa. EPSS 1.0% chance of exploitation in the next 30 days.

An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2019-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

weaver:eteams_oa

References

http://www.iwantacve.cn/index.php/archives/271/
http://www.iwantacve.cn/index.php/archives/271/

Check your stack JSON