Read the docs
TI-2019-12772 Aliases CVE-2019-17118GHSA-qrhm-956g-2f5j

A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker…

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices.

Why it matters now

EPSS 0.00937 61st percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.81:b676:*:*:*:*:*:*3.4.81 b676VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.85:b780:*:*:*:*:*:*3.4.85 b780VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1092:*:*:*:*:*:*3.4.87 b1092VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1159:*:*:*:*:*:*3.4.87 b1159VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1169:*:*:*:*:*:*3.4.87 b1169VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1216:*:*:*:*:*:*3.4.87 b1216VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b824:*:*:*:*:*:*3.4.87 b824VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b839:*:*:*:*:*:*3.4.87 b839VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1342:*:*:*:*:*:*3.5.0 b1342VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1352:*:*:*:*:*:*3.5.0 b1352VulnerableWikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.81:b676:*:*:*:*:*:* Versions 3.4.81 b676 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.85:b780:*:*:*:*:*:* Versions 3.4.85 b780 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1092:*:*:*:*:*:* Versions 3.4.87 b1092 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1159:*:*:*:*:*:* Versions 3.4.87 b1159 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1169:*:*:*:*:*:* Versions 3.4.87 b1169 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b1216:*:*:*:*:*:* Versions 3.4.87 b1216 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b824:*:*:*:*:*:* Versions 3.4.87 b824 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.4.87:b839:*:*:*:*:*:* Versions 3.4.87 b839 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1342:*:*:*:*:*:* Versions 3.5.0 b1342 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1352:*:*:*:*:*:* Versions 3.5.0 b1352 Vulnerable ·Wikidsystems
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1359:*:*:*:*:*:*3.5.0 b1359VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1373:*:*:*:*:*:*3.5.0 b1373VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1403:*:*:*:*:*:*3.5.0 b1403VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1411:*:*:*:*:*:*3.5.0 b1411VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1421:*:*:*:*:*:*3.5.0 b1421VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1428:*:*:*:*:*:*3.5.0 b1428VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1438:*:*:*:*:*:*3.5.0 b1438VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1472:*:*:*:*:*:*3.5.0 b1472VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1542:*:*:*:*:*:*3.5.0 b1542VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1580:*:*:*:*:*:*3.5.0 b1580VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1659:*:*:*:*:*:*3.6.0 b1659VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1672:*:*:*:*:*:*3.6.0 b1672VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1787:*:*:*:*:*:*4.0 b1787VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1798:*:*:*:*:*:*4.0 b1798VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1803:*:*:*:*:*:*4.0 b1803VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1817:*:*:*:*:*:*4.0.1 b1817VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1821:*:*:*:*:*:*4.0.1 b1821VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1905:*:*:*:*:*:*4.0.1 b1905VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1906:*:*:*:*:*:*4.0.1 b1906VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1917:*:*:*:*:*:*4.0.2 b1917VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1921:*:*:*:*:*:*4.0.2 b1921VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1926:*:*:*:*:*:*4.1.0 b1926VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1941:*:*:*:*:*:*4.1.0 b1941VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1949:*:*:*:*:*:*4.1.0 b1949VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1955:*:*:*:*:*:*4.1.0 b1955VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1978:*:*:*:*:*:*4.2.0 b1978VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1981:*:*:*:*:*:*4.2.0 b1981VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1984:*:*:*:*:*:*4.2.0 b1984VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2007:*:*:*:*:*:*4.2.0 b2007VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2014:*:*:*:*:*:*4.2.0 b2014VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2016:*:*:*:*:*:*4.2.0 b2016VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2020:*:*:*:*:*:*4.2.0 b2020VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2023:*:*:*:*:*:*4.2.0 b2023VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2028:*:*:*:*:*:*4.2.0 b2028VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2032:*:*:*:*:*:*4.2.0 b2032VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2047:*:*:*:*:*:*4.2.0 b2047VulnerableWikidsystems
cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2053:*:*:*:*:*:*4.2.0 b2053VulnerableWikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1359:*:*:*:*:*:* Versions 3.5.0 b1359 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1373:*:*:*:*:*:* Versions 3.5.0 b1373 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1403:*:*:*:*:*:* Versions 3.5.0 b1403 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1411:*:*:*:*:*:* Versions 3.5.0 b1411 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1421:*:*:*:*:*:* Versions 3.5.0 b1421 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1428:*:*:*:*:*:* Versions 3.5.0 b1428 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1438:*:*:*:*:*:* Versions 3.5.0 b1438 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1472:*:*:*:*:*:* Versions 3.5.0 b1472 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1542:*:*:*:*:*:* Versions 3.5.0 b1542 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.5.0:b1580:*:*:*:*:*:* Versions 3.5.0 b1580 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1659:*:*:*:*:*:* Versions 3.6.0 b1659 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:3.6.0:b1672:*:*:*:*:*:* Versions 3.6.0 b1672 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1787:*:*:*:*:*:* Versions 4.0 b1787 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1798:*:*:*:*:*:* Versions 4.0 b1798 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0:b1803:*:*:*:*:*:* Versions 4.0 b1803 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1817:*:*:*:*:*:* Versions 4.0.1 b1817 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1821:*:*:*:*:*:* Versions 4.0.1 b1821 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1905:*:*:*:*:*:* Versions 4.0.1 b1905 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.1:b1906:*:*:*:*:*:* Versions 4.0.1 b1906 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1917:*:*:*:*:*:* Versions 4.0.2 b1917 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.0.2:b1921:*:*:*:*:*:* Versions 4.0.2 b1921 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1926:*:*:*:*:*:* Versions 4.1.0 b1926 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1941:*:*:*:*:*:* Versions 4.1.0 b1941 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1949:*:*:*:*:*:* Versions 4.1.0 b1949 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.1.0:b1955:*:*:*:*:*:* Versions 4.1.0 b1955 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1978:*:*:*:*:*:* Versions 4.2.0 b1978 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1981:*:*:*:*:*:* Versions 4.2.0 b1981 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b1984:*:*:*:*:*:* Versions 4.2.0 b1984 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2007:*:*:*:*:*:* Versions 4.2.0 b2007 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2014:*:*:*:*:*:* Versions 4.2.0 b2014 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2016:*:*:*:*:*:* Versions 4.2.0 b2016 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2020:*:*:*:*:*:* Versions 4.2.0 b2020 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2023:*:*:*:*:*:* Versions 4.2.0 b2023 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2028:*:*:*:*:*:* Versions 4.2.0 b2028 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2032:*:*:*:*:*:* Versions 4.2.0 b2032 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2047:*:*:*:*:*:* Versions 4.2.0 b2047 Vulnerable ·Wikidsystems
  • cpe:2.3:a:wikidsystems:2fa_enterprise_server:4.2.0:b2053:*:*:*:*:*:* Versions 4.2.0 b2053 Vulnerable ·Wikidsystems

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17118
  2. 2026-10-03 Alias added: GHSA-qrhm-956g-2f5j

References

Exploit 3

Advisory 1

  • TI-2019-12774 A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise… CVSS 3.1MEDIUM 6.1
  • TI-2019-12771 A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences