PT-2019-13486 · Unknown · Control Center Server

CVE-2019-13947 · Publicado 2019-12-12 · Atualizado 2024-01-09

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Control Center Server (CCS) versions prior to V1.5.0

Description A security issue has been identified where the user configuration menu in the web interface of the Control Center Server (CCS) transfers user passwords in clear text to the client browser. This could allow an attacker with administrative privileges for the web interface to read the passwords of other CCS users.

Recommendations For versions prior to V1.5.0, update to version V1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the user configuration menu in the web interface to minimize the risk of exploitation. Avoid using the web interface for sensitive user configuration tasks until the issue is resolved.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

CWE-317

Identificadores relacionados

CVE-2019-13947

Produtos afetados

Control Center Server

Referências · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13947 · Nota de Segurança