airVision NVR path Parameter Traversal Arbitrary File Access

Medium Nessus Plugin ID 64994

Synopsis

The remote web server hosts an application that is affected by a
directory traversal vulnerability.

Description

The remote web server hosts airVision NVR, an application used to
remotely monitor IP cameras. The installed version of airVision NVR
fails to properly sanitize user-supplied input to the 'path' parameter
of the 'views/file.php' script. This could allow an unauthenticated,
remote attacker to read arbitrary files on the remote host by sending a
request containing directory traversal characters.

Note that the application is reportedly also affected by a SQL injection
vulnerability as well as an additional traversal arbitrary file
disclosure vulnerability via the 'path' parameter of the
'views/image.php' script; however, Nessus has not tested for these
additional issues.

Solution

Unknown at this time.

See Also

https://www.ubnt.com/

Plugin Details

Severity: Medium

ID: 64994

File Name: airvision_nvr_path_file_disclosure.nasl

Version: 1.8

Type: remote

Family: CGI abuses

Published: 2013/03/04

Modified: 2018/11/15

Dependencies: 11936, 10107

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:POC/RL:U/RC:ND

Vulnerability Information

CPE: cpe:/o:ubnt:airvision_firmware

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 2012/10/15

Reference Information

BID: 55921

EDB-ID: 21990