PT-2017-15699 · Acti · Acti Cameras

Mandar Jadhav · Publicado 2017-12-15 · Atualizado 2019-10-09 · CVE-2017-3185

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACTi cameras including the D, B, I, and E series version A1D-500-V6.11.31-AC

Description The web application in the affected cameras uses the GET method to process requests containing sensitive information, such as user account name and password. This can expose the sensitive information through the browser's history, referrers, web logs, and other sources.

Recommendations For version A1D-500-V6.11.31-AC, consider changing the request method from GET to POST to prevent sensitive information from being exposed in the browser's history and web logs. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-598

CWE-200

Identificadores relacionados

CVE-2017-3185

Produtos afetados

Acti Cameras

Referências · 6

• http://securityfocus.com/bid/96720/info · Nota
• https://twitter.com/hack3rsca/status/839599437907386368 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3185 · Nota de Segurança
• https://kb.cert.org/vuls/id/355151 · Nota
• https://osv.dev/vulnerability/CVE-2017-3185 · Aviso do Fabricante
• https://twitter.com/Hfuhs/status/839252357221330944 · Nota