PT-2019-2036 · Siemens · Sinema Remote Connect Server

Publicado 2019-04-09 · Atualizado 2021-03-15 · CVE-2019-6570

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V2.0

Description The issue is related to insufficient checking of user permissions, allowing an attacker to access URLs that require special authorization. To exploit this, an attacker must have access to a low-privileged account. This could enable a remote attacker to access system resources by bypassing the authorization mechanism.

Recommendations For versions prior to V2.0, update to version V2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive URLs and reinforcing account privileges to minimize the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

CWE-280

CWE-264

Identificadores relacionados

BDU:2019-01780

CVE-2019-6570

Produtos afetados

Sinema Remote Connect Server

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-6570 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6570 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01780 · Nota de Segurança