Sign-up

ID

VAR-202003-0778


CVE

CVE-2019-19294


TITLE

SiNVR 3 Central Control Server  and  Video Server  Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2019-014868

DESCRIPTION

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Control Center Server (CCS) contains multiple stored Cross-site Scripting (XSS) vulnerabilities in several input fields. This could allow an authenticated remote attacker to inject malicious JavaScript code into the CCS web application that is later executed in the browser context of any other user who views the relevant CCS web content. SiNVR 3 is a video management platform. Remote attackers can use this vulnerability to inject malicious JavaScript code

Trust: 2.43

sources: NVD: CVE-2019-19294 // JVNDB: JVNDB-2019-014868 // CNVD: CNVD-2020-17007 // IVD: 743ca4cb-2414-4d27-b575-59994d163c85 // VULMON: CVE-2019-19294

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 743ca4cb-2414-4d27-b575-59994d163c85 // CNVD: CNVD-2020-17007

AFFECTED PRODUCTS

vendor:siemensmodel:sinvr 3 central control serverscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:sinvr 3 video serverscope:eqversion:*

Trust: 1.0

vendor:シーメンスmodel:sinvr 3 video serverscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:sinvr 3 central control serverscope: - version: -

Trust: 0.8

vendor:siemensmodel:sinvr central control serverscope:eqversion:3

Trust: 0.6

vendor:siemensmodel:sinvr video serverscope:eqversion:3

Trust: 0.6

vendor:sinvr 3 central control servermodel: - scope:eqversion:*

Trust: 0.2

vendor:sinvr 3 video servermodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 743ca4cb-2414-4d27-b575-59994d163c85 // CNVD: CNVD-2020-17007 // JVNDB: JVNDB-2019-014868 // NVD: CVE-2019-19294

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-19294
value: MEDIUM

Trust: 1.0

productcert@siemens.com: CVE-2019-19294
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-19294
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2020-17007
value: LOW

Trust: 0.6

CNNVD: CNNVD-202003-481
value: MEDIUM

Trust: 0.6

IVD: 743ca4cb-2414-4d27-b575-59994d163c85
value: MEDIUM

Trust: 0.2

VULMON: CVE-2019-19294
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2019-19294
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2020-17007
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 743ca4cb-2414-4d27-b575-59994d163c85
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2019-19294
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2019-19294
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 4.0
version: 3.1

Trust: 1.0

OTHER: JVNDB-2019-014868
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: 743ca4cb-2414-4d27-b575-59994d163c85 // CNVD: CNVD-2020-17007 // VULMON: CVE-2019-19294 // JVNDB: JVNDB-2019-014868 // CNNVD: CNNVD-202003-481 // NVD: CVE-2019-19294 // NVD: CVE-2019-19294

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2019-014868 // NVD: CVE-2019-19294

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-481

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202003-481

PATCH

title:SSA-844761url:https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf

Trust: 0.8

title:Patch for Siemens SiNVR 3 Cross-site Scripting Vulnerability (CNVD-2020-17007)url:https://www.cnvd.org.cn/patchInfo/show/208743

Trust: 0.6

title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=03dd7efb196bdf8da925c4ca8f3d02f6

Trust: 0.1

title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=941d6ca22d089421a99575c44abd4248

Trust: 0.1

sources: CNVD: CNVD-2020-17007 // VULMON: CVE-2019-19294 // JVNDB: JVNDB-2019-014868

EXTERNAL IDS

db:NVDid:CVE-2019-19294

Trust: 4.1

db:SIEMENSid:SSA-761844

Trust: 1.7

db:SIEMENSid:SSA-844761

Trust: 1.7

db:ICS CERTid:ICSA-20-070-01

Trust: 1.4

db:CNVDid:CNVD-2020-17007

Trust: 0.8

db:CNNVDid:CNNVD-202003-481

Trust: 0.8

db:JVNid:JVNVU96269392

Trust: 0.8

db:JVNDBid:JVNDB-2019-014868

Trust: 0.8

db:ICS CERTid:ICSA-21-103-10

Trust: 0.6

db:AUSCERTid:ESB-2021.1240

Trust: 0.6

db:NSFOCUSid:46128

Trust: 0.6

db:IVDid:743CA4CB-2414-4D27-B575-59994D163C85

Trust: 0.2

db:VULMONid:CVE-2019-19294

Trust: 0.1

sources: IVD: 743ca4cb-2414-4d27-b575-59994d163c85 // CNVD: CNVD-2020-17007 // VULMON: CVE-2019-19294 // JVNDB: JVNDB-2019-014868 // CNNVD: CNNVD-202003-481 // NVD: CVE-2019-19294

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2019-19294

Trust: 2.0

url:https://cert-portal.siemens.com/productcert/pdf/ssa-844761.pdf

Trust: 1.7

url:https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf

Trust: 1.7

url:https://www.us-cert.gov/ics/advisories/icsa-20-070-01

Trust: 1.4

url:https://jvn.jp/vu/jvnvu96269392/index.html

Trust: 0.8

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-103-10

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1240

Trust: 0.6

url:http://www.nsfocus.net/vulndb/46128

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/79.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://cert-portal.siemens.com/productcert/txt/ssa-761844.txt

Trust: 0.1

sources: CNVD: CNVD-2020-17007 // VULMON: CVE-2019-19294 // JVNDB: JVNDB-2019-014868 // CNNVD: CNNVD-202003-481 // NVD: CVE-2019-19294

SOURCES

db:IVDid:743ca4cb-2414-4d27-b575-59994d163c85
db:CNVDid:CNVD-2020-17007
db:VULMONid:CVE-2019-19294
db:JVNDBid:JVNDB-2019-014868
db:CNNVDid:CNNVD-202003-481
db:NVDid:CVE-2019-19294

LAST UPDATE DATE

2024-08-14T12:30:26.999000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-17007date:2020-03-13T00:00:00
db:VULMONid:CVE-2019-19294date:2021-04-22T00:00:00
db:JVNDBid:JVNDB-2019-014868date:2024-02-20T07:11:00
db:CNNVDid:CNNVD-202003-481date:2021-04-23T00:00:00
db:NVDid:CVE-2019-19294date:2024-01-09T10:15:12.267

SOURCES RELEASE DATE

db:IVDid:743ca4cb-2414-4d27-b575-59994d163c85date:2020-03-10T00:00:00
db:CNVDid:CNVD-2020-17007date:2020-03-13T00:00:00
db:VULMONid:CVE-2019-19294date:2020-03-10T00:00:00
db:JVNDBid:JVNDB-2019-014868date:2020-03-24T00:00:00
db:CNNVDid:CNNVD-202003-481date:2020-03-10T00:00:00
db:NVDid:CVE-2019-19294date:2020-03-10T20:15:19.413