CVE-2019-20047

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded in a reversible format. Sessions are stored in /sessions/sess_<sessionid>.

• CWE-522

• https://git.lsd.cat/g/omnivista-rceExploit, Third Party Advisory
• https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.al-enterprise.com/en/-/media/assets/internet/documents/sa-c0065-ov8770-rce-vulnerability-en.pdfVendor Advisory
• https://www.exploit-db.com/exploits/47761Exploit, Third Party Advisory, VDB Entry
• https://git.lsd.cat/g/omnivista-rceExploit, Third Party Advisory
• https://packetstormsecurity.com/files/155595/Alcatel-Lucent-Omnivista-8770-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.al-enterprise.com/en/-/media/assets/internet/documents/sa-c0065-ov8770-rce-vulnerability-en.pdfVendor Advisory
• https://www.exploit-db.com/exploits/47761Exploit, Third Party Advisory, VDB Entry

Published

Dec 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20041wp_kses_bad_protocol in wp-includes/kses.php in WordPress be…9.8
• CVE-2019-20042In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the…6.1
• CVE-2019-20043In in wp-includes/rest-api/endpoints/class-wp-rest-posts-con…4.3
• CVE-2019-20044In Zsh before 5.8, attackers able to execute commands can re…7.8
• CVE-2019-20045The Synergy Systems & Solutions PLC & RTU system has a vulne…7.5
• CVE-2019-20046The Synergy Systems & Solutions PLC & RTU system has a vulne…9.8
• CVE-2019-20048An issue was discovered on Alcatel-Lucent OmniVista 8770 dev…7.2
• CVE-2019-20049An issue was discovered on Alcatel-Lucent OmniVista 4760 dev…9.8
• CVE-2019-2005In onPermissionGrantResult of GrantPermissionsActivity.java,…
• CVE-2019-20050Pandora FMS ≤ 7.42 suffers from a remote code execution vuln…6.8
• CVE-2019-20051A floating-point exception was discovered in PackLinuxElf::e…5.5
• CVE-2019-20052A memory leak was discovered in Mat_VarCalloc in mat.c in ma…6.5