CVE-2020-28381

Опубликовано: 12 янв. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-048/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-053/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-074/
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-048/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-053/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-074/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*

Версия до se2020 (исключая)

cpe:2.3:a:siemens:solid_edge:se2020:-:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack1:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack10:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack11:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack2:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack3:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack4:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack5:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack6:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack7:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack8:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack9:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00486

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

GHSA-97x2-phf9-hw3v

github

больше 3 лет назад

A vulnerability has been identified in Solid Edge (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.