Lucene search

SiemensCVE-2020-28387

HistoryMar 15, 2021 - 5:15 p.m.

CVE-2020-28387

2021-03-1517:15:20

CWE-611

siemens

web.nvd.nist.gov

cve-2020-28387

solid edge

se2020

se2021

vulnerability

arbitrary file disclosure

seectcxml

zdi-can-11923

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

0.006

Percentile

78.4%

JSON

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)

Affected configurations

Nvd

Node

siemenssolid_edgeRange<se2021

siemenssolid_edgeMatchse2021-

siemenssolid_edgeMatchse2021maintenance_pack1

VendorProductVersionCPE
siemenssolid_edge*cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*
siemenssolid_edgese2021cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*
siemenssolid_edgese2021cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	solid_edge	*	cpe:2.3:a:siemens:solid_edge::::::::
siemens	solid_edge	se2021	cpe:2.3:a:siemens:solid_edge:se2021:-::::::
siemens	solid_edge	se2021	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1::::::

CNA Affected

[
  {
    "product": "Solid Edge SE2020",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All Versions < SE2020MP13"
      }
    ]
  },
  {
    "product": "Solid Edge SE2021",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All Versions < SE2021MP3"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

0.006

Percentile

78.4%

JSON

Related for CVE-2020-28387