Lucene search
SiemensCVELIST:CVE-2021-37196HistoryJan 11, 2022 - 11:27 a.m.
CVE-2021-37196
2022-01-1111:27:13
CWE-23
siemens
www.cve.org
5
cve-2021-37196
comos v10.2
comos v10.3
comos v10.4
specially crafted archive
relative paths
file storage vulnerability
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.3 (All versions >= V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS unpacks specially crafted archive files to relative paths. This vulnerability could allow an attacker to store files in any folder accessible by the COMOS Web webservice.
CNA Affected
[
{
"product": "COMOS V10.2",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions only if web components are used"
}
]
},
{
"product": "COMOS V10.3",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V10.3.3.3 only if web components are used"
}
]
},
{
"product": "COMOS V10.3",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions >= V10.3.3.3 only if web components are used"
}
]
},
{
"product": "COMOS V10.4",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V10.4.1 only if web components are used"
}
]
}
]Related
prion
prion
Design/Logic Flaw
2022-01-11 12:15:00
nvd
nvd
CVE-2021-37196
2022-01-11 12:15:09
cnvd
cnvd
Siemens COMOS Web Component Path Traversal Vulnerability
2022-01-12 00:00:00
cve
cve
CVE-2021-37196
2022-01-11 12:15:09
ics
ics
Siemens COMOS Web (Update B)
2022-04-14 12:00:00