Mirasys VMS up to 7.6.0/8.3.1 on WordPress SMServer.exe Download path traversal

Summaryinfo

A vulnerability described as critical has been identified in Mirasys VMS up to 7.6.0/8.3.1 on WordPress. Affected is the function Download of the file SMServer.exe. Executing a manipulation with the input ..\ can lead to path traversal. This vulnerability is handled as CVE-2019-11029. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Mirasys VMS up to 7.6.0/8.3.1 on WordPress (WordPress Plugin) and classified as critical. This vulnerability affects the function Download of the file SMServer.exe. The manipulation with the input value ..\ leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.

The weakness was released 08/22/2019. This vulnerability was named CVE-2019-11029 since 04/09/2019. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 7.6.1 or 8.3.2 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-140658 and VDB-140657. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• Mirasys

Name

• VMS

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6.0
• 8.3.0
• 8.3.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion