PT-2023-7002 · Siemens · Siemens Opc Ua Modeling Editor

Published 2023-11-14 · Updated 2023-11-20 · CVE-2023-46590

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens OPC UA Modeling Editor (SiOME) versions prior to V2.8

Description The issue is related to the incorrect restriction of XML links to external objects, which could allow a remote attacker to gain unauthorized access to protected information. This is a XML external entity (XXE) injection vulnerability, which could interfere with an application's processing of XML data and allow the reading of arbitrary files in the system.

Recommendations For versions prior to V2.8, update to version V2.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of XML external entities in the Siemens OPC UA Modeling Editor until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-08021

CVE-2023-46590

Affected Products

Siemens Opc Ua Modeling Editor

References · 7

• https://osv.dev/vulnerability/CVE-2023-46590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46590 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08021 · Security Note
• https://twitter.com/VulmonFeeds/status/1724427026398900483 · Twitter Post
• https://vuldb.com/ru/?id.245156 · Note
• https://twitter.com/CVEnew/status/1724387622254944372 · Twitter Post