SySS Advisory: Reflected XSS in C-MOR Video Surveillance (CVE-2024-45176)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Product: C-MOR Video Surveillance - Manufacturer: za-internet GmbH - Affected Version: 5.2401 - Tested Version: 5.2401 - Vulnerability Type: Reflected Cross-Site Scripting (CWE-79) - Risk Level: Medium - Solution Status: Fixed - Manufacturer Notification Date: 2024-04-05 - Solution Date: 2024-07-31 - Public Disclosure Date: 2024-09-04 - CVE Reference: CVE-2024-45176 - Authors: Chris Beiter, Frederik Beimgraben, and Matthias Deeg 2. Vulnerability Details: - The C-MOR web interface is vulnerable to reflected cross-site scripting due to insufficient input validation. 3. Exploitation: - Analysis of the C-MOR web interface revealed that various functions are susceptible to reflected cross-site scripting. - Attackers can exploit this by sending malicious URLs with crafted parameters, triggering the cross-site scripting attack. 4. Solution: - Install C-MOR Video Surveillance version 6.00PL1. 5. Disclosure Timeline: - 2024-04-05: Vulnerability reported to the manufacturer. - 2024-04-05: Manufacturer confirmed receipt of the security advisory. - 2024-04-08: Communication regarding security update and disclosure timeline. - 2024-05-08: Further communication on security update and disclosure timeline; all security advisories planned for release on 2024-05-10. - 2024-05-10: Release of C-MOR software version 5.30, including security updates. - 2024-07-19: Email regarding the release date of C-MOR Video Surveillance version 6. - 2024-07-30: Manufacturer’s email with further information on security fixes. - 2024-07-31: Release of C-MOR software version 6.00PL1. - 2024-09-04: Public release of the security advisory. 6. References: - Product Website - SySS Security Advisory SYSS-2024-020 - SySS Responsible Disclosure Policy 7. Disclaimer: - Information is provided "as is" and without any warranty. - Information may be updated to provide as accurate information as possible. - The latest version of the security advisory can be found on the SySS website. 8. Copyright: - Creative Commons - Attribution (by) - Version 3.0 - URL: http://creativecommons.org/licenses/by/3.0/deed.en This information provides a detailed description of the reflected cross-site scripting vulnerability in C-MOR Video Surveillance, along with the solution and disclosure timeline.

Goal Reached Thanks to every supporter — we hit 100%!

SySS Advisory: Reflected XSS in C-MOR Video Surveillance (CVE-2024-45176)