PT-2020-19633 · Siemens · Camstar Enterprise Platform+1

Published 2020-07-14 · Updated 2023-02-03 · CVE-2020-7576

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Camstar Enterprise Platform versions all Opcenter Execution Core versions prior to V8.2 Opcenter Execution Core version V8.2

Description A stored Cross-Site Scripting (XSS) attack can be performed by an authenticated user with the ability to create containers, packages, or register defects. This could result in the session cookies of legitimate users being stolen, allowing the attacker to hijack the session and perform arbitrary actions in the name of the victim.

Recommendations For Camstar Enterprise Platform versions all, update to a version that includes the fix for this issue. For Opcenter Execution Core versions prior to V8.2, update to version V8.2 or later. For Opcenter Execution Core version V8.2, consider disabling the functionality that allows users to create containers, packages, or register defects until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-7576

Affected Products

Camstar Enterprise Platform

Opcenter Execution Core

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7576 · Security Note