PT-2019-18169 · Siemens · Siveillance Vms

Published 2019-06-12 · Updated 2020-10-06 · CVE-2019-6582

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Siveillance VMS 2017 R2 versions prior to V11.2a Siveillance VMS 2018 R1 versions prior to V12.1a Siveillance VMS 2018 R2 versions prior to V12.2a Siveillance VMS 2018 R3 versions prior to V12.3a Siveillance VMS 2019 R1 versions prior to V13.1a

Description A security issue allows an attacker with network access to port 80/TCP to modify user-defined event properties without proper authorization. This can be exploited by an authenticated attacker without requiring user interaction, compromising the integrity of event properties and the availability of corresponding functionality. At the time of publication, no public exploitation of this issue was known.

Recommendations For Siveillance VMS 2017 R2, update to version V11.2a or later. For Siveillance VMS 2018 R1, update to version V12.1a or later. For Siveillance VMS 2018 R2, update to version V12.2a or later. For Siveillance VMS 2018 R3, update to version V12.3a or later. For Siveillance VMS 2019 R1, update to version V13.1a or later.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2019-6582

Affected Products

Siveillance Vms

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6582 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6582 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-19-162-01 · Note