PT-2024-8123 · Unknown · Sinec Traffic Analyzer

Published 2024-08-13 · Updated 2024-08-14 · CVE-2024-41907

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V2.0

Description: A vulnerability has been identified in the SINEC Traffic Analyzer application, where the web server is missing general HTTP security headers. This could allow an attacker to make the servers more prone to clickjacking attacks. The issue is related to incorrect security checks for standard elements, which may enable a remote attacker to gain access to confidential information through clickjacking.

Recommendations: For versions prior to V2.0, update to version V2.0 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to mitigate the risk of clickjacking attacks, such as configuring the web server to include general HTTP security headers.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

BDU:2024-09655

CVE-2024-41907

Affected Products

Sinec Traffic Analyzer

References · 7

• https://cert-portal.siemens.com/productcert/html/ssa-716317.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41907 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41907 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09655 · Security Note
• https://t.me/cvedetector/2978 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823274762077958311 · Twitter Post
• https://twitter.com/CVEnew/status/1823272940265148684 · Twitter Post