Information disclosure in CBAS Web - CVE-2019-10849
Published: May 31, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU18649
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-10849
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an unprotected subversion directory. A remote attacker can download the entire firmware codebase and gain unauthorized access to sensitive information about the inner workings of the underlying OS.
Affected software
CBAS Web
How to mitigate CVE-2019-10849
Install updates from vendor's website.
CBAS Web - addressed in versions 3.15.1, 4.8.2, 6.9.2, 7.2.1 Beta, 8.0.7, 14.0.1, 15.0.1, 18.0.1, 19.0.1