CVE-2019-11187: Debian Linux

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.

Affected products

• Debian Debian Linux: version 8.0 only
• Gonicus Gosa: up to and including 2019-04-11

Published 2019-08-15. Last modified 2026-06-17.