Lucene search

SiemensCVE-2019-18338

HistoryDec 12, 2019 - 7:15 p.m.

CVE-2019-18338

2019-12-1219:15:20

CWE-23

CWE-22

siemens

web.nvd.nist.gov

vulnerability

control center server

ccs

directory traversal

xml-based communication

port 5444/tcp

port 5440/tcp

authenticated remote attacker

network access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

65.2%

JSON

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a directory traversal
vulnerability in its XML-based communication protocol as provided by default
on ports 5444/tcp and 5440/tcp.

An authenticated remote attacker with network access to the CCS server
could exploit this vulnerability to list arbitrary directories
or read files outside of the CCS application context.

Affected configurations

Nvd

Node

siemenssinvr_3_central_control_server

siemenssinvr_3_video_server

VendorProductVersionCPE
siemenssinvr_3_central_control_server*cpe:2.3:a:siemens:sinvr_3_central_control_server:*:*:*:*:*:*:*:*
siemenssinvr_3_video_server*cpe:2.3:a:siemens:sinvr_3_video_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	sinvr_3_central_control_server	*	cpe:2.3:a:siemens:sinvr_3_central_control_server::::::::
siemens	sinvr_3_video_server	*	cpe:2.3:a:siemens:sinvr_3_video_server::::::::

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "Control Center Server (CCS)",
    "versions": [
      {
        "version": "All versions < V1.5.0",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf

cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

65.2%

JSON

Related for CVE-2019-18338