PT-2019-12151 · Mirasys · Mirasys Vms

Publicado 2019-08-22 · Atualizado 2019-08-30 · CVE-2019-11031

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mirasys VMS versions prior to 7.6.1 Mirasys VMS versions 8.x prior to 8.3.2

Description The issue arises from the mishandling of the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can exploit this by uploading files with a Setup-Files action and then executing these files with SYSTEM privileges.

Recommendations For versions prior to 7.6.1, update to version 7.6.1 or later. For versions 8.x prior to 8.3.2, update to version 8.3.2 or later.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-11031

Produtos afetados

Mirasys Vms

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-11031 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11031 · Aviso do Fabricante
• https://kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution · Nota