MEDIUM
Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
Published Aug 29, 2019
6.1
MEDIUMCVSS 3.0
EPSS 1.05%
Description
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
Affected products
-
Affected
- up to 230
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| AndroVideo | Advan VD-1 firmware | unknown | Affected
|
Configuration 1
AND
- ≤ 230
Running on/with
- n/a
Configuration 2
AND
- ≤ 1.10
Configuration 3
AND
- ≤ 1.01
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- http://surl.twcert.org.tw/SpTwh x_refsource_CONFIRMThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4901 Advisory
- https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md x_refsource_CONFIRMExploitThird Party Advisory
- https://tvn.twcert.org.tw/taiwanvn/TVN-201906008 x_refsource_CONFIRMThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://surl.twcert.org.tw/SpTwh | x_refsource_CONFIRMThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4901 | Advisory | |
| https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md | x_refsource_CONFIRMExploitThird Party Advisory | |
| https://tvn.twcert.org.tw/taiwanvn/TVN-201906008 | x_refsource_CONFIRMThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner twcert
Published Aug 29, 2019
Updated Sep 16, 2024
Reserved Jul 8, 2019
Link CVE-2019-13407
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data