PT-2022-21182 · Siemens · Sinema Remote Connect Server

Published 2022-06-14 · Updated 2024-07-09 · CVE-2022-32256

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.1

Description A vulnerability has been identified in the SINEMA Remote Connect Server, where the web service lacks proper access control for some endpoints. This could lead to low privileged users accessing privileged information.

Recommendations For versions prior to V3.1, update to version V3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-32256

Affected Products

Sinema Remote Connect Server

References · 5

• https://osv.dev/vulnerability/CVE-2022-32256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32256 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-484086.html · Note
• https://t.me/cibsecurity/44379 · Telegram Post