CVE-2019-19994 - An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29

Back Back to CVE browser

CRITICAL

An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29

Published Feb 26, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 4.84%

Description

An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vam_monitor_sap.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9582
Advisory
https://www.seling.it/
x_refsource_MISCProduct
https://www.seling.it/product/vam/
x_refsource_MISCProductVendor Advisory
https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9582		Advisory
https://www.seling.it/		x_refsource_MISCProduct
https://www.seling.it/product/vam/		x_refsource_MISCProductVendor Advisory
https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html		x_refsource_MISCExploitThird Party Advisory