Liman Mys
Monthly
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.
Privilege escalation and unauthorized functionality access in HAVELSAN Liman MYS (Yönetim Sistemi) before release.Master.1107 allows an authenticated low-privileged user to invoke functions that should be gated by access-control lists. Because certain endpoints fail to enforce authorization (CWE-862), a limited user can reach administrative or restricted operations, enabling significant integrity and availability impact. No public exploit identified at time of analysis; the flaw was reported by Turkey's national CERT (TR-CERT / USOM).
Privilege escalation in Liman MYS (HAVELSAN Inc.) versions 2.2.3 through pre-2.3.1 enables authenticated low-privilege users to gain administrator-level access via missing server-side authorization checks (CWE-862). The platform, a centralized Linux server management system used primarily in Turkish government and enterprise environments, fails to verify whether the requesting user has rights to perform privileged operations before executing them. No public exploit identified at time of analysis, but the CVSS 8.8 score with network vector and low privilege requirement makes this a high-priority patch target for any organization running the affected versions.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.
Privilege escalation and unauthorized functionality access in HAVELSAN Liman MYS (Yönetim Sistemi) before release.Master.1107 allows an authenticated low-privileged user to invoke functions that should be gated by access-control lists. Because certain endpoints fail to enforce authorization (CWE-862), a limited user can reach administrative or restricted operations, enabling significant integrity and availability impact. No public exploit identified at time of analysis; the flaw was reported by Turkey's national CERT (TR-CERT / USOM).