PT-2019-5351 · Siemens · Sppa-T3000 Application Server

Publicado 2019-12-10 · Atualizado 2022-03-04 · CVE-2019-18284

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SPPA-T3000 Application Server versions prior to Service Pack R8.2 SP2

Description The issue is related to the availability of the AdminService without authentication on the Application Server, allowing an attacker to access server administration services and obtain password hashes of server application users. An attacker can exploit this to change user passwords, but they need access to the Application Highway. There are no known public exploitations of this issue at the time of reporting.

Recommendations For versions prior to Service Pack R8.2 SP2, update to Service Pack R8.2 SP2 or later to resolve the issue. As a temporary workaround, consider restricting access to the AdminService interface until a patch is available.

Correção

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

BDU:2020-02447

CVE-2019-18284

Produtos afetados

Sppa-T3000 Application Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-18284 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-02447 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18284 · Aviso do Fabricante
• http://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html · Nota
• https://packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.html · Nota