Lucene search

SiemensCVE-2020-15794

HistoryOct 15, 2020 - 7:15 p.m.

CVE-2020-15794

2020-10-1519:15:12

CWE-200

CWE-209

siemens

web.nvd.nist.gov

cve-2020-15794

desigo insight

vulnerability

authenticated attacker

absolute path disclosure

web application

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system.

Affected configurations

Nvd

Node

siemensdesigo_insightRange<6.0

siemensdesigo_insightMatch6.0-

siemensdesigo_insightMatch6.0sp2

siemensdesigo_insightMatch6.0sp3

siemensdesigo_insightMatch6.0sp5

VendorProductVersionCPE
siemensdesigo_insight*cpe:2.3:a:siemens:desigo_insight:*:*:*:*:*:*:*:*
siemensdesigo_insight6.0cpe:2.3:a:siemens:desigo_insight:6.0:-:*:*:*:*:*:*
siemensdesigo_insight6.0cpe:2.3:a:siemens:desigo_insight:6.0:sp2:*:*:*:*:*:*
siemensdesigo_insight6.0cpe:2.3:a:siemens:desigo_insight:6.0:sp3:*:*:*:*:*:*
siemensdesigo_insight6.0cpe:2.3:a:siemens:desigo_insight:6.0:sp5:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	desigo_insight	*	cpe:2.3:a:siemens:desigo_insight::::::::
siemens	desigo_insight	6.0	cpe:2.3:a:siemens:desigo_insight:6.0:-::::::
siemens	desigo_insight	6.0	cpe:2.3:a:siemens:desigo_insight:6.0:sp2::::::
siemens	desigo_insight	6.0	cpe:2.3:a:siemens:desigo_insight:6.0:sp3::::::
siemens	desigo_insight	6.0	cpe:2.3:a:siemens:desigo_insight:6.0:sp5::::::

CNA Affected

[
  {
    "product": "Desigo Insight",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf

us-cert.cisa.gov/ics/advisories/icsa-20-287-05

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2020-15794