PT-2024-31461 · Za Internet · C-Mor

Chris Beiter + 2 · Published 2024-09-04 · Updated 2024-09-05 · CVE-2024-45177

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions za-internet C-MOR Video Surveillance versions 5.2401 through 6.00PL01

Description The issue is related to improper input validation in the C-MOR web interface, making it vulnerable to persistent cross-site scripting (XSS) attacks. This allows an attacker to inject malicious scripts remotely. The camera configuration is specifically vulnerable due to insufficient user input validation.

Recommendations For versions 5.2401 and 6.00PL01, update the system with a patch as soon as possible and validate input/output to mitigate the risk. As a temporary workaround, consider restricting access to the C-MOR web interface until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45177

Affected Products

C-Mor

References · 8

• 🔥 http://seclists.org/fulldisclosure/2024/Sep/9 · Exploit
• https://osv.dev/vulnerability/CVE-2024-45177 · Vendor Advisory
• https://syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45177 · Security Note
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-021.txt · Vendor Advisory
• https://twitter.com/CVEnew/status/1831396514876551264 · Twitter Post
• https://twitter.com/oktsec/status/1831455724443935153 · Twitter Post
• https://t.me/cvedetector/4828 · Telegram Post