PT-2020-10306 · Selesta · Selesta Visual Access Manager

Published 2020-02-26 · Updated 2020-02-27 · CVE-2019-19987

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29

Description The issue allows Cross-Site Request Forgery (CSRF) on any HTML form, enabling an attacker to abuse functionalities such as changing passwords, adding users, adding privileges, and more.

Recommendations For versions 4.15.0 through 4.29, consider implementing CSRF protection mechanisms, such as token-based validation, to prevent exploitation of the vulnerable HTML forms. As a temporary workaround, restrict access to sensitive functionalities like change password, add user, and add privilege until a proper fix is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-19987

Affected Products

Selesta Visual Access Manager

References · 5

• 🔥 https://telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-19987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19987 · Security Note
• https://seling.it/product/vam · Vendor Advisory
• https://seling.it · Note