CVE-2019-11029

HIGH

Mirasys VMS < 7.6.1 and 8.x < 8.3.2 - Unauthenticated Path Traversal via AutoUpdateService Download Method

Title source: llm

Description

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://www.kyberturvallisuuskeskus.fi/en/vulnerabilities-mirasys-vms-video-management-solution

Scores

CVSS v3 7.5

EPSS 0.0244

EPSS Percentile 82.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (1)

mirasys/mirasys_vms < 7.6.1

Published Aug 22, 2019

Tracked Since Feb 18, 2026