SySS Advisory SYSS-2024-022: C-MOR Video Surveillance CSRF Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Product: C-MOR Video Surveillance - Vendor: za-internet GmbH - Affected Versions: 5.2401, 6.00PL01 - Tested Versions: 5.2401, 6.00PL01 - Vulnerability Type: Cross-Site Request Forgery (CSRF) (CWE-352) - Risk Level: Medium 2. Vulnerability Details: - The C-MOR web interface provides no protection against CSRF attacks. - CSRF attacks can target state-changing requests, such as enabling or disabling features, rather than data theft, since attackers typically cannot view the response to forged requests. - CSRF attacks can be executed when a victim accesses a URL controlled by the attacker, for example, via a link sent in an email. 3. Solution: - No fix for this security issue is available. 4. Disclosure Timeline: - April 5, 2024: Vulnerability reported to the vendor. - April 5, 2024: Vendor confirmed receipt of the security advisory. - April 8, 2024: Communication regarding security updates and disclosure timeline. - May 8, 2024: Further communication regarding security updates and disclosure timeline; all security advisories planned for release in June 2024. - May 10, 2024: Release of C-MOR software version 5.30, including updates for some reported security issues. - July 19, 2024: Email notification to vendor regarding the release date of C-MOR Video Surveillance version 6; response planned for August 1, 2024. - July 30, 2024: Email notification to vendor with additional information regarding C-MOR Video Surveillance version 6. - July 31, 2024: Release of C-MOR software version 6.00PL1. - September 4, 2024: Security advisory published. 5. References: - C-MOR Video Surveillance product website: https://www.c-mor.com/ - SySS Security Advisory SYSS-2024-022: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-022.txt - SySS Responsible Disclosure Policy: https://www.syss.de/en/responsible-disclosure-policy/ 6. Disclaimer: - Information is provided "as is" and without any warranty. - Details of the security advisory may be updated to provide as accurate information as possible. - The latest version of the security advisory can be found on the SySS website. 7. Copyright: - Creative Commons - Attribution (by) - Version 3.0 - URL: http://creativecommons.org/licenses/by/3.0/deed.en This information provides a detailed description of the CSRF vulnerability in the C-MOR Video Surveillance system, along with the solution and disclosure timeline.

Goal Reached Thanks to every supporter — we hit 100%!

SySS Advisory SYSS-2024-022: C-MOR Video Surveillance CSRF Vulnerability