CVE-2023-46282

Опубликовано: 12 дек. 2023

Источник: nvd

CVSS3: 7.1

CVSS3: 6.1

EPSS Низкий

Описание

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected applications that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user.

Ссылки

https://cert-portal.siemens.com/productcert/html/ssa-999588.html
https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf
Patch
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-999588.html
https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:opcenter_quality:-:*:*:*:*:*:*:*

cpe:2.3:a:siemens:simatic_pcs_neo:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:a:siemens:sinumerik_integrate_runmyhmi_\/automotive:-:*:*:*:*:*:*:*

cpe:2.3:a:siemens:totally_integrated_automation_portal:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 15 (исключая)

cpe:2.3:a:siemens:totally_integrated_automation_portal:*:*:*:*:*:*:*:*

Версия от 15 (включая) до 16 (исключая)

cpe:2.3:a:siemens:totally_integrated_automation_portal:*:*:*:*:*:*:*:*

Версия от 16 (включая) до 17 (исключая)

cpe:2.3:a:siemens:totally_integrated_automation_portal:*:*:*:*:*:*:*:*

Версия от 17 (включая) до 18 (исключая)

cpe:2.3:a:siemens:totally_integrated_automation_portal:-:*:*:*:*:*:*:*

cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:*

cpe:2.3:a:siemens:totally_integrated_automation_portal:18:update_1:*:*:*:*:*:*

EPSS

Процентиль: 31%

0.00121

Низкий

7.1 High

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-fmr5-j3hh-jpg4

CVSS3: 7.1

github

около 2 лет назад

A vulnerability has been identified in Opcenter Quality (All versions), SIMATIC PCS neo (All versions < V4.1), SINUMERIK Integrate RunMyHMI /Automotive (All versions), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected applications that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user.

BDU:2023-08844

CVSS3: 7.1

fstec

около 2 лет назад

Уязвимость системы управления производственными процессами Opcenter Quality, веб-системы управления технологическими процессами SIMATIC PCS neo, программного средства автоматизации и управления производственными процессами SINUMERIK Integrate RunMyHMI/Automotive, среды разработки программного обеспечения систем автоматизации технологических процессов Totally Integrated Automation Portal (Portal TIA), связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 31%

0.00121

Низкий

7.1 High

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79