A vulnerability was found in Cisco Video Surveillance Manager (Video Surveillance Software) (the affected version is unknown). It has been classified as problematic. This affects an unknown code of the component Web-based Management Interface. The manipulation as part of a Parameter leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to an affected component. A successful exploit could allow the attacker to download arbitrary files from the affected device, which could contain sensitive information.

The bug was discovered 05/15/2019. The weakness was shared 05/15/2019 as cisco-sa-20190515-cvsm as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2019-1717 since 12/06/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/19/2023). MITRE ATT&CK project uses the attack technique T1006 for this issue.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 13497 (Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerability(cisco-sa-20190515-cvsm)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-272390, VDB-273174, VDB-273907 and VDB-273909 are related to this item.

Productinfo

Type

• Video Surveillance Software

Vendor

• Cisco

Name

• Video Surveillance Manager

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion