CVE-2020-28386

Опубликовано: 12 янв. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-060/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-077/
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-060/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-077/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*

Версия до se2020 (исключая)

cpe:2.3:a:siemens:solid_edge:se2020:-:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack1:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack10:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack11:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack2:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack3:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack4:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack5:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack6:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack7:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack8:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack9:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*

cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00468

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

GHSA-j9xp-4524-r98c

github

больше 3 лет назад

A vulnerability has been identified in Solid Edge (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.