PT-2019-15356 · Unknown · Control Center Server

CVE-2019-18337 · Publicado 2019-12-12 · Atualizado 2024-01-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Control Center Server (CCS) versions prior to V1.5.0

Description A remote attacker with network access to the CCS server could exploit an authentication bypass vulnerability in the XML-based communication protocol, as provided by default on ports 5444/tcp and 5440/tcp, to read the CCS users database, including the passwords of all users in obfuscated cleartext.

Recommendations For versions prior to V1.5.0, update to version V1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to ports 5444/tcp and 5440/tcp to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-18337

Produtos afetados

Control Center Server

Referências · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf · Aviso do Fabricante
• https://t.me/cvenotify/13148 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-18337 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf · Nota