CVE-2019-13408

🗓️ 29 Aug 2019 00:18:52Reported by twcertType

cve🔗 web.nvd.nist.gov👁 159 Views🌐 WEB

Relative path traversal vuln Advan VD-1 firmware, allows download arbitrary file

Reporter	Title	Published	Views	Family All 6
CNVD	AndroVideo Advan VD-1 Path Traversal Vulnerability	29 Aug 201900:00	–	cnvd
Cvelist	CVE-2019-13408 Advan VD-1 allows users to download arbitrary files	29 Aug 201900:18	–	cvelist
EUVD	EUVD-2019-4902	7 Oct 202500:30	–	euvd
NVD	CVE-2019-13408	29 Aug 201901:15	–	nvd
Prion	Path traversal	29 Aug 201901:15	–	prion
Tenable Nessus	GeoVision GV-VR360 and GV-VD8700 Path Traversal (CVE-2019-13408)	19 Nov 202400:00	–	nessus

NVD

Vulners

Node

androvideo vd_1_firmwareRange≤230

AND

androvideo vd_1Match-

Node

geovision gv-vr360_firmwareRange≤1.10

AND

geovision gv-vr360Match-

Node

geovision gv-vd8700_firmwareRange≤1.01

AND

geovision gv-vd8700Match-

[
  {
    "product": "Advan VD-1 firmware",
    "vendor": "AndroVideo",
    "versions": [
      {
        "status": "affected",
        "version": "up to 230"
      }
    ]
  }
]

Source	Link
gist	www.gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b
tvn	www.tvn.twcert.org.tw/taiwanvn/TVN-201906009
surl	www.surl.twcert.org.tw/2bvXq

Parameter	Position	Path	Description	CWE
Download	query param	cgibin/ExportSettings.cgi	Path traversal via the Download parameter allows downloading arbitrary files without authentication.	CWE-23, CWE-862, CWE-22

21 Nov 2024 04:24Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.17.5

EPSS0.00533

cve-2019-13408 relative path traversal advan vd-1 firmware vulnerability file download vulnerability nvd