PT-2019-2036 · Siemens · Sinema Remote Connect Server

Published 2019-04-09 · Updated 2021-03-15 · CVE-2019-6570

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V2.0

Description The issue is related to insufficient checking of user permissions, allowing an attacker to access URLs that require special authorization. To exploit this, an attacker must have access to a low-privileged account. This could enable a remote attacker to access system resources by bypassing the authorization mechanism.

Recommendations For versions prior to V2.0, update to version V2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive URLs and reinforcing account privileges to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-280

CWE-264

Related Identifiers

BDU:2019-01780

CVE-2019-6570

Affected Products

Sinema Remote Connect Server

References · 4

• https://osv.dev/vulnerability/CVE-2019-6570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6570 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01780 · Security Note