PT-2022-18307 · Siemens · Sinema Remote Connect Server

Published 2022-06-14 · Updated 2022-06-23 · CVE-2022-27219

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.0 SP2

Description A vulnerability has been identified in the SINEMA Remote Connect Server where the affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks, and other similar client-based attack vectors.

Recommendations For versions prior to V3.0 SP2, update to V3.0 SP2 or later to resolve the issue. As a temporary workaround, consider configuring the web server to include general HTTP security headers to minimize the risk of exploitation. Restrict access to the web server configured on port 443 to minimize the risk of clickjacking and channel downgrade attacks.

Fix

Clickjacking

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-1021

CWE-358

Related Identifiers

CVE-2022-27219

Affected Products

Sinema Remote Connect Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-27219 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27219 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf · Vendor Advisory
• https://t.me/cibsecurity/44395 · Telegram Post