CVE-2020-15792

Опубликовано: 15 окт. 2020

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack.

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05
Third Party Advisory
US Government Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:desigo_insight:*:*:*:*:*:*:*:*

Версия до 6.0 (исключая)

cpe:2.3:a:siemens:desigo_insight:6.0:-:*:*:*:*:*:*

cpe:2.3:a:siemens:desigo_insight:6.0:sp2:*:*:*:*:*:*

cpe:2.3:a:siemens:desigo_insight:6.0:sp3:*:*:*:*:*:*

cpe:2.3:a:siemens:desigo_insight:6.0:sp5:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00214

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-fgw3-qp45-8h2h