PT-2020-6994 · Siemens · Desigo Insight

Published 2020-10-13 · Updated 2020-10-21 · CVE-2020-15793

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Desigo Insight (All versions)

Description The issue is related to the device not properly setting the X-Frame-Options HTTP Header, making it susceptible to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user into clicking on a website controlled by the attacker. Additionally, the vulnerability is associated with incorrect restriction of visualizable layers in the user interface, which can be exploited by a remote attacker to redirect a user to an arbitrary site.

Recommendations For Desigo Insight (All versions), consider implementing proper X-Frame-Options HTTP Header settings to prevent Clickjacking attacks. As a temporary workaround, restrict access to the user interface to minimize the risk of exploitation. Avoid using the Desigo Insight interface on untrusted websites until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2024-10620

CVE-2020-15793

Affected Products

Desigo Insight

References · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10620 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-15793 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15793 · Vendor Advisory
• https://feedly.com/cve/CVE-2020-15793 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05 · Note
• https://gruppotim.it/it/footer/red-team.html · Note