Path Traversal in C-Mor Video Surveillance
CVE-2024-45178
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.013 (66.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Affected products
- C-mor C-mor_video_surveillance — versions 5.2401
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Vendor Advisory)
- cve@mitre.org (Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Exploit, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-45178?
- CVE-2024-45178 is a high-severity vulnerability in C-Mor Video Surveillance, classified under Path Traversal. CVSS score: 7.1/10. Published 2024-09-05.
- How severe is CVE-2024-45178?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2024-45178 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.