PT-2022-21180 · Siemens · Sinema Remote Connect Server

Published 2022-06-14 · Updated 2024-07-09 · CVE-2022-32254

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.1

Description A vulnerability has been identified that could expose sensitive user information. This occurs when a customized HTTP POST request forces the application to write the status of a given user to a log file, potentially providing valuable guidance to an attacker.

Recommendations For versions prior to V3.1, update to version V3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the log file to minimize the risk of exploitation. Avoid using customized HTTP POST requests that could force the application to write sensitive user information to the log file until the issue is resolved.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-32254

Affected Products

Sinema Remote Connect Server

References · 5

• https://osv.dev/vulnerability/CVE-2022-32254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32254 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-484086.html · Note
• https://t.me/cibsecurity/44362 · Telegram Post