LOYTEC LVIS-3ME ICSA-17-257-01 Multiple Security Vulnerabilities

Bugtraq ID:	100847
Class:	Unknown
CVE:	CVE-2017-13996 CVE-2017-13992 CVE-2017-13994 CVE-2017-13998
Remote:	Yes
Local:	No
Published:	Sep 14 2017 12:00AM
Updated:	Sep 14 2017 12:00AM
Credit:	Davy Douhine of RandoriSec
Vulnerable:	LOYTEC LVIS-3ME 0
Not Vulnerable:	LOYTEC LVIS-3ME 6.2

LOYTEC LVIS-3ME ICSA-17-257-01 Multiple Security Vulnerabilities

LOYTEC LVIS-3ME is prone to the following security vulnerabilities: :

1. A directory-traversal vulnerability
2. An insufficient-entropy vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability

An attacker may leverage these issues to execute script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, execute arbitrary code within the context of the affected system or use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application.

Versions prior to LVIS-3ME 6.2.0 are vulnerable.

LOYTEC LVIS-3ME ICSA-17-257-01 Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LOYTEC LVIS-3ME ICSA-17-257-01 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

LOYTEC LVIS-3ME ICSA-17-257-01 Multiple Security Vulnerabilities

References:

• Loytec Homepage (Loytec)
  
• Advisory (ICSA-17-257-01) LOYTEC LVIS-3ME (CERT)