PT-2021-11120 · Siemens · Sinema Remote Connect Server

Published 2021-03-15 · Updated 2021-03-18 · CVE-2020-25240

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.0

Description: A vulnerability has been identified that allows unprivileged users to access services by guessing the URL. This could impact availability and integrity, and potentially allow an attacker to gain information from logs and templates of the service.

Recommendations: For versions prior to V3.0, update to version V3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the service to prevent unprivileged users from guessing the URL and accessing sensitive information.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-25240

Affected Products

Sinema Remote Connect Server

References · 4

• https://osv.dev/vulnerability/CVE-2020-25240 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-731317.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25240 · Security Note
• https://t.me/cibsecurity/24901 · Telegram Post