PT-2019-18168 · Siemens · Siveillance Vms

Publicado 2019-06-12 · Atualizado 2020-10-16 · CVE-2019-6581

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siveillance VMS 2017 R2 versions prior to V11.2a Siveillance VMS 2018 R1 versions prior to V12.1a Siveillance VMS 2018 R2 versions prior to V12.2a Siveillance VMS 2018 R3 versions prior to V12.3a Siveillance VMS 2019 R1 versions prior to V13.1a

Description A security issue has been identified that allows an attacker with network access to port 80/TCP to change user roles without proper authorization. The issue can be exploited by an authenticated attacker with network access to the affected service, and no user interaction is required. Successful exploitation compromises the confidentiality, integrity, and availability of the targeted system. At the time of advisory publication, no public exploitation of this issue was known.

Recommendations For Siveillance VMS 2017 R2 versions prior to V11.2a, update to version V11.2a or later. For Siveillance VMS 2018 R1 versions prior to V12.1a, update to version V12.1a or later. For Siveillance VMS 2018 R2 versions prior to V12.2a, update to version V12.2a or later. For Siveillance VMS 2018 R3 versions prior to V12.3a, update to version V12.3a or later. For Siveillance VMS 2019 R1 versions prior to V13.1a, update to version V13.1a or later.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2019-6581

Produtos afetados

Siveillance Vms

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6581 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6581 · Aviso do Fabricante