PT-2022-4096 · Siemens · Simcenter Star-Ccm+

Published 2022-08-09 · Updated 2022-08-16 · CVE-2022-34659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simcenter STAR-CCM+ versions prior to the fixed version, when the Power-on-Demand public license server is used

Description The issue is related to errors in information processing, potentially allowing a remote attacker to gain unauthorized access to protected information about the host and displayed user names. The vulnerability exposes user, host, and display name of users when the public license server is used, which could be retrieved by an attacker.

Recommendations For Simcenter STAR-CCM+ versions using the Power-on-Demand public license server, consider disabling the public license server until a patch is available to prevent exposure of user information. As a temporary workaround, restrict access to the public license server to minimize the risk of exploitation. Avoid using the public license server in Simcenter STAR-CCM+ until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-04931

CVE-2022-34659

Affected Products

Simcenter Star-Ccm+

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-555707.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34659 · Security Note
• https://t.me/cibsecurity/47853 · Telegram Post