CVE-2019-13408 - Vulnerability Details - OpenCVE

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Androvideo	Vd 1 Vd 1 Firmware
Geovision	Gv-vd8700 Gv-vd8700 Firmware Gv-vr360 Gv-vr360 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:androvideo:vd_1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:androvideo:vd_1:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:geovision:gv-vr360_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:geovision:gv-vr360:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:geovision:gv-vd8700_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:geovision:gv-vd8700:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://surl.twcert.org.tw/2bvXq
https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md
https://tvn.twcert.org.tw/taiwanvn/TVN-201906009

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2019-08-29T00:18:52.900362Z

Updated: 2024-09-17T01:26:55.568Z

Reserved: 2019-07-08T00:00:00

Link: CVE-2019-13408

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-08-29T01:15:11.803

Modified: 2024-11-21T04:24:53.087

Link: CVE-2019-13408

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Advan VD-1 firmware", "vendor": "AndroVideo", "versions": [{"status": "affected", "version": "up to 230"}]}], "credits": [{"lang": "en", "value": "Keniver Wang (CHT Security)"}], "datePublic": "2019-08-20T00:00:00", "descriptions": [{"lang": "en", "value": "A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-08-29T00:18:52", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://surl.twcert.org.tw/2bvXq"}], "source": {"discovery": "EXTERNAL"}, "title": "Advan VD-1 allows users to download arbitrary files", "x_generator": {"engine": "Vulnogram 0.0.7"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2019-08-20T16:00:00.000Z", "ID": "CVE-2019-13408", "STATE": "PUBLIC", "TITLE": "Advan VD-1 allows users to download arbitrary files"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Advan VD-1 firmware", "version": {"version_data": [{"version_value": "up to 230"}]}}]}, "vendor_name": "AndroVideo"}]}}, "credit": [{"lang": "eng", "value": "Keniver Wang (CHT Security)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication."}]}, "generator": {"engine": "Vulnogram 0.0.7"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-23 Relative Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md", "refsource": "CONFIRM", "url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"}, {"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009", "refsource": "CONFIRM", "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"}, {"name": "http://surl.twcert.org.tw/2bvXq", "refsource": "CONFIRM", "url": "http://surl.twcert.org.tw/2bvXq"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:49:25.018Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://surl.twcert.org.tw/2bvXq"}]}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2019-13408", "datePublished": "2019-08-29T00:18:52.900362Z", "dateReserved": "2019-07-08T00:00:00", "dateUpdated": "2024-09-17T01:26:55.568Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:androvideo:vd_1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3DD30743-4857-42DE-853E-0AB67F1D2ADE", "versionEndIncluding": "230", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:androvideo:vd_1:-:*:*:*:*:*:*:*", "matchCriteriaId": "B1574006-94D7-4144-BE9D-FD28A920FF65", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:geovision:gv-vr360_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "743F5C10-A4FF-4966-A176-58C6CDD3D769", "versionEndIncluding": "1.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:geovision:gv-vr360:-:*:*:*:*:*:*:*", "matchCriteriaId": "D3E10A54-A224-4F1C-AC58-83A9C616A354", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:geovision:gv-vd8700_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "64A08F29-4477-49CF-A84F-32555A2A95A1", "versionEndIncluding": "1.01", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:geovision:gv-vd8700:-:*:*:*:*:*:*:*", "matchCriteriaId": "2CB7CE78-58AA-4C0A-B45F-52E08AB0F9E9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication."}, {"lang": "es", "value": "Una vulnerabilidad de recorrido de ruta relativa encontrada en las versiones de firmware de Advan VD-1 hasta 230. Permite a los atacantes descargar archivos arbitrarios a trav\u00e9s de url cgibin/ExportSettings.cgi? Ruta de descarga de archivos, sin ninguna autenticaci\u00f3n."}], "id": "CVE-2019-13408", "lastModified": "2024-11-21T04:24:53.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-08-29T01:15:11.803", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "http://surl.twcert.org.tw/2bvXq"}, {"source": "twcert@cert.org.tw", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://surl.twcert.org.tw/2bvXq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "twcert@cert.org.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}