PT-2024-8751 · Siemens · Sinema Remote Connect Server

Published 2024-07-09 · Updated 2024-08-07 · CVE-2024-39875

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SINEMA Remote Connect Server versions prior to V3.2 SP1

Description The issue is related to the incorrect assignment of permissions for a critical resource in the Group Membership Handler component. This can allow a remote attacker to gain unauthorized access to protected information. The affected application allows authenticated, low-privilege users with the Manage own remote connections permission to retrieve details about other users and group memberships.

Recommendations For versions prior to V3.2 SP1, update to version V3.2 SP1 or later to resolve the issue. As a temporary workaround, consider restricting the Manage own remote connections permission to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2024-10355

CVE-2024-39875

Affected Products

Sinema Remote Connect Server

References · 8

• https://bdu.fstec.ru/vul/2024-10355 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-381581.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39875 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39875 · Vendor Advisory
• https://vuldb.com/?id.270672 · Note
• https://twitter.com/VulmonFeeds/status/1810695733038780749 · Twitter Post
• https://t.me/cvedetector/329 · Telegram Post
• https://twitter.com/CVEnew/status/1810651971952796044 · Twitter Post