PT-2022-10639 · Siemens · Comos

Published 2022-01-11 · Updated 2022-04-29 · CVE-2021-37195

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions COMOS versions V10.2 through V10.4.1, but only if web components are used, specifically: COMOS V10.2 COMOS versions V10.3 through V10.3.3.2 COMOS versions V10.4 through V10.4.0

Description A vulnerability has been identified in the COMOS Web component, which accepts arbitrary code as an attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment.

Recommendations For COMOS V10.2, consider disabling the web component until a patch is available. For COMOS versions V10.3 through V10.3.3.2, consider disabling the web component until a patch is available. For COMOS versions V10.4 through V10.4.0, consider disabling the web component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2021-37195

Affected Products

Comos

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-37195 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37195 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf · Vendor Advisory
• https://t.me/cibsecurity/35225 · Telegram Post