var-202003-0775
Vulnerability from variot
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0). The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server (CCS) maintain log files that store login credentials in cleartext. In configurations where the FTP service is enabled, authenticated remote attackers could extract login credentials of other users of the service. SiNVR 3 is a video management platform.
SiNVR 3 saves the login credentials in plain text in the log file. There is an information disclosure vulnerability in the implementation. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202003-0775", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "sinvr 3 central control server", "scope": "eq", "trust": 1.0, "vendor": "siemens", "version": "*" }, { "model": "sinvr 3 video server", "scope": "eq", "trust": 1.0, "vendor": "siemens", "version": "*" }, { "model": "sinvr 3 video server", "scope": "eq", "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "sinvr 3 central control server", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "sinvr central control server", "scope": "eq", "trust": 0.6, "vendor": "siemens", "version": "3" }, { "model": "sinvr video server", "scope": "eq", "trust": 0.6, "vendor": "siemens", "version": "3" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "sinvr 3 central control server", "version": "*" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "sinvr 3 video server", "version": "*" } ], "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "NVD", "id": "CVE-2019-19291" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:siemens:sinvr_3_central_control_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:sinvr_3_video_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2019-19291" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Siemens reported these vulnerabilities to CISA.", "sources": [ { "db": "CNNVD", "id": "CNNVD-202003-475" } ], "trust": 0.6 }, "cve": "CVE-2019-19291", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 6.8, "impactScore": 2.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "Single", "author": "NVD", "availabilityImpact": "None", "baseScore": 3.5, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2019-19291", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Low", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "CNVD", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 6.8, "id": "CNVD-2020-17014", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 0.6, "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "IVD", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 6.8, "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 0.2, "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.9 [IVD]" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, { "attackComplexity": "HIGH", "attackVector": "NETWORK", "author": "productcert@siemens.com", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.6, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, { "attackComplexity": "High", "attackVector": "Network", "author": "OTHER", "availabilityImpact": "None", "baseScore": 5.3, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "JVNDB-2019-014872", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2019-19291", "trust": 1.8, "value": "MEDIUM" }, { "author": "productcert@siemens.com", "id": "CVE-2019-19291", "trust": 1.0, "value": "MEDIUM" }, { "author": "CNVD", "id": "CNVD-2020-17014", "trust": 0.6, "value": "LOW" }, { "author": "CNNVD", "id": "CNNVD-202104-975", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-202003-475", "trust": 0.6, "value": "MEDIUM" }, { "author": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32", "trust": 0.2, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2019-19291", "trust": 0.1, "value": "LOW" } ] } ], "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "VULMON", "id": "CVE-2019-19291" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-202003-475" }, { "db": "NVD", "id": "CVE-2019-19291" }, { "db": "NVD", "id": "CVE-2019-19291" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability has been identified in Control Center Server (CCS) (All versions \u003c V1.5.0), SiNVR/SiVMS Video Server (All versions \u003c V5.0.0). The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server (CCS) maintain\nlog files that store login credentials in cleartext. \nIn configurations where the FTP service is enabled, authenticated remote\nattackers could extract login credentials of other users of the service. SiNVR 3 is a video management platform. \n\r\n\r\nSiNVR 3 saves the login credentials in plain text in the log file. There is an information disclosure vulnerability in the implementation. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements", "sources": [ { "db": "NVD", "id": "CVE-2019-19291" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "VULMON", "id": "CVE-2019-19291" } ], "trust": 2.97 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-19291", "trust": 4.1 }, { "db": "SIEMENS", "id": "SSA-761844", "trust": 1.7 }, { "db": "SIEMENS", "id": "SSA-844761", "trust": 1.7 }, { "db": "ICS CERT", "id": "ICSA-20-070-01", "trust": 1.4 }, { "db": "CNVD", "id": "CNVD-2020-17014", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-202003-475", "trust": 0.8 }, { "db": "JVN", "id": "JVNVU96269392", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2019-014872", "trust": 0.8 }, { "db": "CS-HELP", "id": "SB2021041363", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202104-975", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2021041517", "trust": 0.6 }, { "db": "ICS CERT", "id": "ICSA-21-103-10", "trust": 0.6 }, { "db": "NSFOCUS", "id": "46125", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2021.1240", "trust": 0.6 }, { "db": "IVD", "id": "FA26A4B9-AD52-4E6D-94D3-990BF1F05D32", "trust": 0.2 }, { "db": "VULMON", "id": "CVE-2019-19291", "trust": 0.1 } ], "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "VULMON", "id": "CVE-2019-19291" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-202003-475" }, { "db": "NVD", "id": "CVE-2019-19291" } ] }, "id": "VAR-202003-0775", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" } ], "trust": 1.454873825 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS" ], "sub_category": null, "trust": 0.8 } ], "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" } ] }, "last_update_date": "2024-02-20T21:40:03.943000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "SSA-844761", "trust": 0.8, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf" }, { "title": "Patch for Siemens SiNVR 3 Plain Text Save File Vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/208749" }, { "title": "Siemens Security Advisories: Siemens Security Advisory", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=03dd7efb196bdf8da925c4ca8f3d02f6" }, { "title": "Siemens Security Advisories: Siemens Security Advisory", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=941d6ca22d089421a99575c44abd4248" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "VULMON", "id": "CVE-2019-19291" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-313", "trust": 1.0 }, { "problemtype": "Plaintext storage of important information (CWE-312) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "NVD", "id": "CVE-2019-19291" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.0, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19291" }, { "trust": 1.7, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf" }, { "trust": 1.7, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf" }, { "trust": 1.4, "url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-01" }, { "trust": 0.8, "url": "https://jvn.jp/vu/jvnvu96269392/index.html" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/46125" }, { "trust": 0.6, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-070-01" }, { "trust": 0.6, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-10" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2021.1240" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021041517" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/313.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://cert-portal.siemens.com/productcert/txt/ssa-761844.txt" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "VULMON", "id": "CVE-2019-19291" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-202003-475" }, { "db": "NVD", "id": "CVE-2019-19291" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" }, { "db": "VULMON", "id": "CVE-2019-19291" }, { "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-202003-475" }, { "db": "NVD", "id": "CVE-2019-19291" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-03-10T00:00:00", "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "date": "2020-03-13T00:00:00", "db": "CNVD", "id": "CNVD-2020-17014" }, { "date": "2020-03-10T00:00:00", "db": "VULMON", "id": "CVE-2019-19291" }, { "date": "2020-03-24T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "date": "2021-04-13T00:00:00", "db": "CNNVD", "id": "CNNVD-202104-975" }, { "date": "2020-03-10T00:00:00", "db": "CNNVD", "id": "CNNVD-202003-475" }, { "date": "2020-03-10T20:15:19.180000", "db": "NVD", "id": "CVE-2019-19291" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-03-13T00:00:00", "db": "CNVD", "id": "CNVD-2020-17014" }, { "date": "2021-04-22T00:00:00", "db": "VULMON", "id": "CVE-2019-19291" }, { "date": "2024-02-20T07:05:00", "db": "JVNDB", "id": "JVNDB-2019-014872" }, { "date": "2021-04-14T00:00:00", "db": "CNNVD", "id": "CNNVD-202104-975" }, { "date": "2021-08-11T00:00:00", "db": "CNNVD", "id": "CNNVD-202003-475" }, { "date": "2024-01-09T10:15:11.373000", "db": "NVD", "id": "CVE-2019-19291" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202003-475" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Siemens SiNVR 3 Plain text save file vulnerability", "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNVD", "id": "CNVD-2020-17014" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "other", "sources": [ { "db": "IVD", "id": "fa26a4b9-ad52-4e6d-94d3-990bf1f05d32" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-202003-475" } ], "trust": 1.4 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.