CVE-2019-11029
High
Description
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.
SeverityHigh
CVSS7.5
Exploit probability—
ProductMirasys Vms
PublishedAug 22, 2019
First seenAug 22, 2019
How to fix
Update
- mirasys mirasys_vms7.6.1, 8.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mirasys mirasys_vms | v < 7.6.1, 8.0.0 ≤ v < 8.3.2 | 7.6.1, 8.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.