CVE-2022-30229

Опубликовано: 14 июн. 2022

Источник: nvd

CVSS3: 7.2

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known.

Ссылки

https://cert-portal.siemens.com/productcert/html/ssa-631336.html
https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf
Patch
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-631336.pdf
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:arm:*:*:*

Версия до 2.6.6 (исключая)

cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:gds_arm:*:*:*

Версия до 2.6.6 (исключая)

cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:gds_intel:*:*:*

Версия до 2.6.6 (исключая)

cpe:2.3:a:siemens:sicam_gridedge_essential:*:*:*:*:intel:*:*:*

Версия до 2.6.6 (исключая)

EPSS

Процентиль: 57%

0.00353

Низкий

7.2 High

CVSS3

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-306

CWE-287

Связанные уязвимости

GHSA-w7w8-pmxh-5jhc

CVSS3: 5.3

github

больше 3 лет назад

A vulnerability has been identified in SICAM GridEdge Essential ARM (All versions < V2.6.6), SICAM GridEdge Essential Intel (All versions < V2.6.6), SICAM GridEdge Essential with GDS ARM (All versions < V2.6.6), SICAM GridEdge Essential with GDS Intel (All versions < V2.6.6). The affected software does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of an user, such as credentials, in case that user's id is known.

EPSS

Процентиль: 57%

0.00353

Низкий

7.2 High

CVSS3

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-306

CWE-287