PT-2020-14638 · Siemens · Desigo Insight

Published 2020-10-15 · Updated 2021-11-18 · CVE-2020-15794

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Desigo Insight (All versions)

Description A vulnerability has been identified that could allow an authenticated attacker to retrieve additional information about the host system. This is due to some error messages in the web application showing the absolute path to the requested resource.

Recommendations For all versions, consider restricting access to error messages or modifying the web application to mask absolute paths in error messages until a fix is available.

Fix

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

CVE-2020-15794

Affected Products

Desigo Insight

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15794 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15794 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05 · Note