PT-2012-4124 · Siemens · Wincc

Andrey Medov + 7 · Publicado 2012-06-08 · Atualizado 2012-06-12 · CVE-2012-2596

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2

Description The issue concerns the XPath functionality in web applications, which does not properly handle special characters in parameters. This allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

Recommendations For Siemens WinCC version 7.0 SP3 before Update 2, update to a version that includes Update 2 to resolve the issue. As a temporary workaround, consider restricting access to the XPath functionality to minimize the risk of exploitation. Avoid using special characters in parameters for the affected web applications until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-2596

Produtos afetados

Wincc

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-2596 · Nota de Segurança
• http://us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf · Nota
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf · Aviso do Fabricante