PT-2024-29881 · Siemens · Sinema Remote Connect Client

Published 2024-09-10 · Updated 2024-09-10 · CVE-2024-42344

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Client versions prior to V3.2 SP2

Description A vulnerability has been identified where the affected application inserts sensitive information into a log file. This log file is readable by all legitimate users of the underlying system, potentially allowing an authenticated attacker to compromise the confidentiality of other users' configuration data.

Recommendations For versions prior to V3.2 SP2, update to version V3.2 SP2 or later to resolve the issue. As a temporary workaround, consider restricting access to the log file to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-42344

Affected Products

Sinema Remote Connect Client

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-42344 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-417159.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42344 · Vendor Advisory
• https://twitter.com/CVEnew/status/1833443204487606738 · Twitter Post
• https://t.me/cvedetector/5212 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833495050463969539 · Twitter Post