SALTO ProAccess SPACE 5.5 Traversal / File Write / XSS / Bypass Vulnerabilities

SALTO ProAccess SPACE versions 5.5 and below suffer from path traversal, arbitrary file write, persistent cross site scripting, privilege escalation, and clear text transmission of sensitive data vulnerabilities. ======================================================================= title:...

SALTO ProAccess SPACE Path Traversal Vulnerability

Salto Systems ProAccess SPACE is a web-based access control management tool from Salto Systems, Spain. A path traversal vulnerability exists in Salto Systems ProAccess SPACE version 5.4.3.0. The vulnerability stems from a failure of a networked system or product to properly filter special element...

PT-2019-15844

Name of the Vulnerable Software and Affected Versions SALTO ProAccess SPACE version 5.4.3.0 Description An issue allows an attacker to write arbitrary content to arbitrary files. This can be used to execute arbitrary commands on the server by writing to files under the web root or creating .bat...

PT-2019-15843

Name of the Vulnerable Software and Affected Versions SALTO ProAccess SPACE version 5.4.3.0 Description The issue allows Directory Traversal in the Data Export feature. Recommendations For version 5.4.3.0, at the moment, there is no information about a newer version that contains a fix for this...

PT-2019-15845

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is against the principle of least privilege. An attacker who is able to exploit CVE-2019-19458 or CVE-2019-19459 is basically able to write to...

CVE-2019-19460: Incorrect Default Permissions

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is against the principle of least privilege. An attacker who is able to exploit CVE-2019-19458 or CVE-2019-19459 is basically able to write to...

CVE-2019-19458: Improper Limitation of a Pathname to a Restricted Directory

SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature...

CVE-2019-19459: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE-2019-19458 files under the web root, or .bat files that will be used with auto start. This allows an attacker to execute arbitrary commands on the server...

CVE-2019-19457: Improper Neutralization of Input During Web Page Generation

SALTO ProAccess SPACE 5.4.3.0 allows XSS...

PT-2019-15842

Name of the Vulnerable Software and Affected Versions SALTO ProAccess SPACE version 5.4.3.0 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...

SALTO ProAccess SPACE Cross-Site Scripting Vulnerability

Salto Systems ProAccess SPACE is a web-based access control management tool from Salto Systems, Spain. A cross-site scripting vulnerability exists in Salto Systems ProAccess SPACE version 5.4.3.0. The vulnerability stems from a lack of proper validation of client data by the WEB application. An...