PT-2022-19373 · Siemens · Sinema Remote Connect Server

Steffen Robertz · Published 2022-06-14 · Updated 2024-07-09 · CVE-2022-29034

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.1

Description A vulnerability has been identified in the web interface of the affected application, where an error message pop-up window does not prevent the injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks.

Recommendations For versions prior to V3.1, update to version V3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the web interface until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29034

Affected Products

Sinema Remote Connect Server

References · 6

• 🔥 http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2022/Jun/35 · Exploit
• https://osv.dev/vulnerability/CVE-2022-29034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29034 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-484086.html · Note