PT-2018-10750 · Hanwha+1 · Hanwha Web Viewer+1

Yavuz Atlas · Publicado 2018-06-14 · Atualizado 2022-04-24 · CVE-2018-11689

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hanwha Web Viewer version 2.17 Samsung Web Viewer (affected versions not specified)

Description The issue affects the Web Viewer for Hanwha DVR and Smart Viewer in Samsung Web Viewer for Samsung DVR, allowing for XSS attacks. The vulnerability can be exploited via the /cgi-bin/webviewer login page API endpoint, specifically through the data3 parameter.

Recommendations For Hanwha Web Viewer version 2.17, avoid using the data3 parameter in the /cgi-bin/webviewer login page API endpoint until the issue is resolved. For Samsung Web Viewer, restrict access to the /cgi-bin/webviewer login page API endpoint to minimize the risk of exploitation, as the affected versions are not specified. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-11689

Produtos afetados

Hanwha Web Viewer

Samsung Web Viewer

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2018/Jun/40 · Exploit
• 🔥 https://seclists.org/bugtraq/2018/Jun/40 · Exploit
• 🔥 https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing · Exploit
• 🔥 http://securityfocus.com/archive/1/542083/100/0/threaded · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11689 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11689 · Aviso do Fabricante
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11689 · Nota