PT-2021-24121 · Unknown · Sipass Integrated+1

Published 2021-12-14 · Updated 2021-12-17 · CVE-2021-44523

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SiPass integrated versions 2.76 through 2.85 Siveillance Identity versions 1.5 through 1.6.283

Description: A vulnerability has been identified in the affected applications, where they insufficiently limit access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify, or delete activity feed entries.

Recommendations: For SiPass integrated versions 2.76 through 2.85, restrict access to the internal activity feed database until a patch is available. For Siveillance Identity versions 1.5 through 1.6.283, consider disabling access to the activity feed database to minimize the risk of exploitation. As a temporary workaround, limit access to the internal activity feed database for all affected versions until a fix is provided.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-44523

Affected Products

Sipass Integrated

Siveillance Identity

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-160202.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44523 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-463116.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44523 · Security Note
• https://t.me/cibsecurity/33916 · Telegram Post