Read the docs
TI-2019-03718 Aliases CVE-2019-5289GHSA-4g65-5v3f-q9xx

Out-of-bounds read in ManageOne

Priority LOW 34CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Gauss100 OLTP database in ManageOne with versions of 6.5.0 have an out-of-bounds read vulnerability due to the insufficient checks of the specific packet length. Attackers can construct invalid packets to attack the active and standby communication channels. Successful exploit of this vulnerability could allow the attacker to crash the database on the standby node.

Why it matters now

EPSS 0.00745 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ManageOne6.5.0—No fix listedCNA
  • ManageOne Vendor— Affected 6.5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:huawei:manageone:6.5.0:*:*:*:*:*:*:*6.5.0VulnerableHuawei
  • cpe:2.3:a:huawei:manageone:6.5.0:*:*:*:*:*:*:* Versions 6.5.0 Vulnerable ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5289
  2. 2026-10-03 Alias added: GHSA-4g65-5v3f-q9xx

References

Advisory 1

  • TI-2021-05269 Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. CVSS 3.1HIGH 7.5
  • TI-2019-11040 Buffer overflow in Linux kernel CVSS 3.1HIGH 7.8
  • TI-2021-05274 There is a local privilege escalation vulnerability in some Huawei products. CVSS 3.1HIGH 7.8
  • TI-2020-07326 Improper input validation in ManageOne CVSS 3.1HIGH 7.2
  • TI-2021-05289 There is a local privilege escalation vulnerability in some versions of ManageOne. CVSS 3.1HIGH 7.8
  • TI-2021-05286 Incorrect default permissions in ManageOne CVSS 3.1HIGH 7.2
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences