PT-2023-7002 · Siemens · Siemens Opc Ua Modeling Editor

Publicado 2023-11-14 · Atualizado 2023-11-20 · CVE-2023-46590

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens OPC UA Modeling Editor (SiOME) versions prior to V2.8

Description The issue is related to the incorrect restriction of XML links to external objects, which could allow a remote attacker to gain unauthorized access to protected information. This is a XML external entity (XXE) injection vulnerability, which could interfere with an application's processing of XML data and allow the reading of arbitrary files in the system.

Recommendations For versions prior to V2.8, update to version V2.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of XML external entities in the Siemens OPC UA Modeling Editor until a patch is available.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2023-08021

CVE-2023-46590

Produtos afetados

Siemens Opc Ua Modeling Editor

Referências · 7

• https://twitter.com/VulmonFeeds/status/1724427026398900483 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-46590 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46590 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08021 · Nota de Segurança
• https://vuldb.com/ru/?id.245156 · Nota
• https://twitter.com/CVEnew/status/1724387622254944372 · Publicação no Twitter