CVE-2012-2596

2012-06-0818:00:00

certcc

www.cve.org

siemens wincc xpath xml injection

AI Score

6.1

Confidence

Low

EPSS

0.001

Percentile

49.6%

JSON

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an “XML injection” attack.