airVision NVR path Parameter Traversal Arbitrary File Access

Medium Nessus Plugin ID 64994

Synopsis

The remote web server hosts an application that is affected by a directory traversal vulnerability.

Description

The remote web server hosts airVision NVR, an application used to remotely monitor IP cameras. The installed version of airVision NVR fails to properly sanitize user-supplied input to the 'path' parameter of the 'views/file.php' script. This could allow an unauthenticated, remote attacker to read arbitrary files on the remote host by sending a request containing directory traversal characters.

Note that the application is reportedly also affected by a SQL injection vulnerability as well as an additional traversal arbitrary file disclosure vulnerability via the 'path' parameter of the 'views/image.php' script; however, Nessus has not tested for these additional issues.

Solution

Unknown at this time.

See Also

https://www.ubnt.com/

Plugin Details

Severity: Medium

ID: 64994

File Name: airvision_nvr_path_file_disclosure.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 2013/03/04

Updated: 2019/06/04

Dependencies: 10107, 11936

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:POC/RL:U/RC:ND

Vulnerability Information

CPE: cpe:/o:ubnt:airvision_firmware

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 2012/10/15

Reference Information

BID: 55921

EDB-ID: 21990