PT-2019-15333 · Siemens · Sppa-T3000 Ms3000 Migration Server

Publicado 2019-12-12 · Atualizado 2022-03-05 · CVE-2019-18313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SPPA-T3000 MS3000 Migration Server (All versions)

Description A vulnerability has been identified that allows an attacker with network access to the MS3000 Server to gain remote code execution by sending specifically crafted objects to one of the RPC services. Note that an attacker needs to have network access to the MS3000 in order to exploit this issue. At the time of advisory publication, no public exploitation of this security issue was known.

Recommendations For all versions, there is no information about a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the RPC services to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-18313

Produtos afetados

Sppa-T3000 Ms3000 Migration Server

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-18313 · Nota de Segurança
• https://t.me/cvenotify/27788 · Publicação no Telegram
• https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf · Aviso do Fabricante