PT-2019-13486 · Unknown · Control Center Server

Published 2019-12-12 · Updated 2024-01-09 · CVE-2019-13947

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Control Center Server (CCS) versions prior to V1.5.0

Description A security issue has been identified where the user configuration menu in the web interface of the Control Center Server (CCS) transfers user passwords in clear text to the client browser. This could allow an attacker with administrative privileges for the web interface to read the passwords of other CCS users.

Recommendations For versions prior to V1.5.0, update to version V1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the user configuration menu in the web interface to minimize the risk of exploitation. Avoid using the web interface for sensitive user configuration tasks until the issue is resolved.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-317

Related Identifiers

CVE-2019-13947

Affected Products

Control Center Server

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13947 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf · Note