PT-2019-18169 · Siemens · Siveillance Vms

Publicado 2019-06-12 · Atualizado 2020-10-06 · CVE-2019-6582

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Siveillance VMS 2017 R2 versions prior to V11.2a Siveillance VMS 2018 R1 versions prior to V12.1a Siveillance VMS 2018 R2 versions prior to V12.2a Siveillance VMS 2018 R3 versions prior to V12.3a Siveillance VMS 2019 R1 versions prior to V13.1a

Description A security issue allows an attacker with network access to port 80/TCP to modify user-defined event properties without proper authorization. This can be exploited by an authenticated attacker without requiring user interaction, compromising the integrity of event properties and the availability of corresponding functionality. At the time of publication, no public exploitation of this issue was known.

Recommendations For Siveillance VMS 2017 R2, update to version V11.2a or later. For Siveillance VMS 2018 R1, update to version V12.1a or later. For Siveillance VMS 2018 R2, update to version V12.2a or later. For Siveillance VMS 2018 R3, update to version V12.3a or later. For Siveillance VMS 2019 R1, update to version V13.1a or later.

Correção

Incorrect Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-863

CWE-285

Identificadores relacionados

CVE-2019-6582

Produtos afetados

Siveillance Vms

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6582 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6582 · Aviso do Fabricante