CVE-2019-19990 : What You Need to Know

Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29 contain multiple Stored Cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML into specific web pages.

Understanding CVE-2019-19990

This CVE involves security vulnerabilities in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29, allowing for Stored Cross-site scripting (XSS) attacks.

What is CVE-2019-19990?

CVE-2019-19990 refers to multiple instances of Stored Cross-site scripting (XSS) vulnerabilities in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. These vulnerabilities enable authenticated remote attackers to inject malicious web scripts or HTML into certain web pages.

The Impact of CVE-2019-19990

The vulnerabilities in CVE-2019-19990 can be exploited by remote authenticated users to compromise the integrity and security of the affected web pages, potentially leading to unauthorized data access or manipulation.

Technical Details of CVE-2019-19990

This section provides detailed technical insights into the CVE-2019-19990 vulnerability.

Vulnerability Description

The problem involves multiple instances of Stored Cross-site scripting (XSS) vulnerabilities in Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. Attackers with remote authenticated access can inject arbitrary web script or HTML into specific web pages such as /monitor/s_headmodel.php and /vam/vam_user.php.

Affected Systems and Versions

Affected Product: Selesta Visual Access Manager (VAM)
Affected Versions: 4.15.0 through 4.29

Exploitation Mechanism

The vulnerabilities can be exploited by individuals with remote authenticated access to inject malicious web scripts or HTML into targeted web pages, compromising the security and functionality of the affected systems.

Mitigation and Prevention

Protecting systems from CVE-2019-19990 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Selesta Visual Access Manager (VAM) to a patched version that addresses the XSS vulnerabilities.
Monitor and restrict access to vulnerable web pages to prevent unauthorized injections.

Long-Term Security Practices

Implement secure coding practices to mitigate XSS vulnerabilities in web applications.
Conduct regular security assessments and penetration testing to identify and address potential security weaknesses.

Patching and Updates

Regularly apply security patches and updates provided by the software vendor to address known vulnerabilities and enhance system security.