CVE-2019-19988 : Security Advisory and Response

A vulnerability has been identified in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29 that allows an attacker with valid login credentials to manipulate XML files on the system through the web interface.

Understanding CVE-2019-19988

This CVE describes a security issue in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29 that enables unauthorized users to create and modify XML files on the system.

What is CVE-2019-19988?

The vulnerability in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29 allows a user with valid login credentials to generate and modify XML files on the system through a specific PHP page in the web interface. The lack of proper checks on crucial parameters enables an attacker to manipulate file names and create files of any format within the system.

The Impact of CVE-2019-19988

The vulnerability poses a significant risk as it allows attackers to create arbitrary files with potentially malicious content on the system, compromising data integrity and system security.

Technical Details of CVE-2019-19988

This section provides detailed technical information about the CVE.

Vulnerability Description

The vulnerable PHP page in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29 lacks proper validation of parameters related to file creation, allowing attackers to manipulate file names and content.

Affected Systems and Versions

Affected Versions: 4.15.0 through 4.29 of Selesta Visual Access Manager (VAM)

Exploitation Mechanism

Attackers with valid login credentials can exploit the vulnerability through the /common/vam_editXml.php page in the web interface.

Mitigation and Prevention

Protecting systems from CVE-2019-19988 requires immediate actions and long-term security practices.

Immediate Steps to Take

Disable access to the vulnerable /common/vam_editXml.php page if not essential
Monitor file creation and modification activities for suspicious behavior

Long-Term Security Practices

Implement strict input validation and sanitization mechanisms in web applications
Conduct regular security assessments and penetration testing to identify vulnerabilities

Patching and Updates

Apply patches or updates provided by the vendor to address the vulnerability in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29