PT-2023-6401 · Sinec Nms · Sinec Nms

Published 2023-10-10 · Updated 2024-07-09 · CVE-2023-44315

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to V2.0

Description The issue arises from the improper sanitization of certain SNMP configuration data retrieved from monitored devices. This could allow an attacker with access to a monitored device to prepare a stored cross-site scripting (XSS) attack, potentially leading to unintentional modification of application data by legitimate users. The vulnerability may be exploited by a remote attacker to conduct an XSS attack.

Recommendations For versions prior to V2.0, update to version V2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to monitored devices to minimize the risk of exploitation. Avoid using the affected SNMP configuration data in the application until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07115

CVE-2023-44315

Affected Products

Sinec Nms

References · 8

• https://bdu.fstec.ru/vul/2023-07115 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-160243.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44315 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-160243.html · Note
• https://support.industry.siemens.com/cs/document/109824030/download-and-sales-and-delivery-release-for-the-product-sinec-nms-v2-0-?dti=0&lc=en-WW · Note
• https://vuldb.com/?id.241693 · Note
• https://support.industry.siemens.com/cs/document/109824030/download-and-sales-and-delivery-release-for-the-product-sinec-nms-v2-0-?dti=0&lc=en-WW · Note