Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-41542 (GCVE-0-2021-41542)
Vulnerability from cvelistv5
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
URL | Tags | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
Siemens | Climatix POL909 (AWB module) |
Version: All versions < V11.44 |
|||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T03:15:28.699Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Climatix POL909 (AWB module)", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V11.44" } ] }, { "product": "Climatix POL909 (AWM module)", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V11.36" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-08T11:31:11", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-41542", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Climatix POL909 (AWB module)", "version": { "version_data": [ { "version_value": "All versions \u003c V11.44" } ] } }, { "product_name": "Climatix POL909 (AWM module)", "version": { "version_data": [ { "version_value": "All versions \u003c V11.36" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2021-41542", "datePublished": "2022-03-08T11:31:11", "dateReserved": "2021-09-21T00:00:00", "dateUpdated": "2024-08-04T03:15:28.699Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-41542\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2022-03-08T12:15:10.697\",\"lastModified\":\"2024-11-21T06:26:22.987\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en Climatix POL909 (m\u00f3dulo AWB) (Todas las versiones anteriores a V11.44), Climatix POL909 (m\u00f3dulo AWM) (Todas las versiones anteriores a V11.36). La p\u00e1gina de administraci\u00f3n de usuarios de los dispositivos afectados es vulnerable a un ataque de tipo cross-site scripting (XSS). La vulnerabilidad permite a un atacante enviar c\u00f3digo JavaScript malicioso que podr\u00eda resultar en el secuestro de los tokens de cookies/sesi\u00f3n del usuario, redirigiendo al usuario a una p\u00e1gina web maliciosa y llevando a cabo una acci\u00f3n no deseada en el navegador\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:*\",\"versionEndExcluding\":\"11.36\",\"matchCriteriaId\":\"8726D1E7-A120-4A48-958D-1767465AB1BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:*\",\"versionEndExcluding\":\"11.44\",\"matchCriteriaId\":\"820A1DB6-C7BC-45BB-B843-1B6F1D803BDA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:climatix_pol909:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"256380A1-0197-4FED-AF9B-E05D59C7D1F1\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}" } }
CERTFR-2022-AVI-216
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
- Mendix Forgot Password Appstore module versions 3.2.x antérieures à 3.2.2
- Mendix Forgot Password Appstore module versions 3.3.x à 3.5.x antérieures à 3.5.1
- Mendix Applications utilisant Mendix versions 7.x antérieures à 7.23.29
- Mendix Applications utilisant Mendix versions 8.x antérieures à 8.18.16
- COMOS versions antérieures à 10.4.1
- Simcenter STAR-CCM+ Viewer versions antérieures à V2022.1
- SIMOTICS CONNECT 400 versions antérieures à 1.0.0.0
- Climatix POL909 (module AWB) versions antérieures à 11.44
- Climatix POL909 (module AWM) versions antérieures à 11.36
- RUGGEDCOM ROS M2100, RMC8388, RS416v2, RS900G, RS900G (32M), RSG900, RSG920P, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions antérieures à 5.6.0
- SINUMERIK MC versions antérieures à 1.15 SP1
- SINUMERIK ONE versions antérieures à 6.15 SP1
- SINEC INS versions antérieures à 1.0.1.1
- RUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 et RX5000 versions antérieures à 2.15.0
- Polarion Subversion Webclient versions antérieures à 21 R2 P2
- RUGGEDCOM ROS i800, i801, i802, i803, M969, M2100, M2200, RMC, RMC20, RMC30, RMC40, RMC41, RMC8388, RP110, RS400, RS401, RS416, RS416v2, RS900 (32M), RS900G, RS900G (32M), RS900GP, RS900L, RS900L, RS900W, RS910, RS910L, RS910W, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RS8000, RS8000A, RS8000H, RS8000T, RSG900, RSG900C, RSG900G, RSG900R, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSG2100, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2200, RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions antérieures à 5.6.0
L'éditeur ne propose pas de correctif pour :
- Mendix Applications utilisant Mendix versions 9
- SINEC NMS toutes versions
Se référer aux mesures de contournement proposées dans la section Documentation.
Vendor | Product | Description |
---|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [], "affected_systems_content": "\u003cul\u003e \u003cli\u003eMendix Forgot Password Appstore module versions 3.2.x ant\u00e9rieures \u00e0 3.2.2\u003c/li\u003e \u003cli\u003eMendix Forgot Password Appstore module versions 3.3.x \u00e0 3.5.x ant\u00e9rieures \u00e0 3.5.1\u003c/li\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 7.x ant\u00e9rieures \u00e0 7.23.29\u003c/li\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 8.x ant\u00e9rieures \u00e0 8.18.16\u003c/li\u003e \u003cli\u003eCOMOS versions ant\u00e9rieures \u00e0 10.4.1\u003c/li\u003e \u003cli\u003eSimcenter STAR-CCM+ Viewer versions ant\u00e9rieures \u00e0 V2022.1\u003c/li\u003e \u003cli\u003eSIMOTICS CONNECT 400 versions ant\u00e9rieures \u00e0 1.0.0.0\u003c/li\u003e \u003cli\u003eClimatix POL909 (module AWB) versions ant\u00e9rieures \u00e0 11.44\u003c/li\u003e \u003cli\u003eClimatix POL909 (module AWM) versions ant\u00e9rieures \u00e0 11.36\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROS M2100, RMC8388, RS416v2, RS900G, RS900G (32M), RSG900, RSG920P, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions ant\u00e9rieures \u00e0 5.6.0\u003c/li\u003e \u003cli\u003eSINUMERIK MC versions ant\u00e9rieures \u00e0 1.15 SP1\u003c/li\u003e \u003cli\u003eSINUMERIK ONE versions ant\u00e9rieures \u00e0 6.15 SP1\u003c/li\u003e \u003cli\u003eSINEC INS versions ant\u00e9rieures \u00e0 1.0.1.1\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 et RX5000 versions ant\u00e9rieures \u00e0 2.15.0\u003c/li\u003e \u003cli\u003ePolarion Subversion Webclient versions ant\u00e9rieures \u00e0 21 R2 P2\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROS i800, i801, i802, i803, M969, M2100, M2200, RMC, RMC20, RMC30, RMC40, RMC41, RMC8388, RP110, RS400, RS401, RS416, RS416v2, RS900 (32M), RS900G, RS900G (32M), RS900GP, RS900L, RS900L, RS900W, RS910, RS910L, RS910W, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RS8000, RS8000A, RS8000H, RS8000T, RSG900, RSG900C, RSG900G, RSG900R, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSG2100, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2200, RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions ant\u00e9rieures \u00e0 5.6.0\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur ne propose pas de correctif pour :\u003c/p\u003e \u003cul\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 9\u003c/li\u003e \u003cli\u003eSINEC NMS toutes versions\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eSe r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es dans la section Documentation.\u003c/p\u003e \u003cp\u003e\u0026nbsp;\u003c/p\u003e ", "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2021-44478", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44478" }, { "name": "CVE-2021-22898", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22898" }, { "name": "CVE-2020-13871", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13871" }, { "name": "CVE-2021-42017", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42017" }, { "name": "CVE-2022-24282", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24282" }, { "name": "CVE-2021-25215", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25215" }, { "name": "CVE-2019-19317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19317" }, { "name": "CVE-2020-8169", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8169" }, { "name": "CVE-2021-25174", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25174" }, { "name": "CVE-2021-22925", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22925" }, { "name": "CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "name": "CVE-2021-32944", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32944" }, { "name": "CVE-2019-19244", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19244" }, { "name": "CVE-2021-27290", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27290" }, { "name": "CVE-2021-42020", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42020" }, { "name": "CVE-2020-8285", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8285" }, { "name": "CVE-2021-22901", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22901" }, { "name": "CVE-2021-22940", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22940" }, { "name": "CVE-2021-32804", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32804" }, { "name": "CVE-2020-13632", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13632" }, { "name": "CVE-2022-24281", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24281" }, { "name": "CVE-2021-32936", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32936" }, { "name": "CVE-2021-22930", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22930" }, { "name": "CVE-2019-19926", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19926" }, { "name": "CVE-2020-9327", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9327" }, { "name": "CVE-2020-8286", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8286" }, { "name": "CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "name": "CVE-2021-22918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22918" }, { "name": "CVE-2020-27304", "url": "https://www.cve.org/CVERecord?id=CVE-2020-27304" }, { "name": "CVE-2021-32946", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32946" }, { "name": "CVE-2021-41543", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41543" }, { "name": "CVE-2020-8177", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8177" }, { "name": "CVE-2020-1971", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1971" }, { "name": "CVE-2020-13630", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13630" }, { "name": "CVE-2021-3450", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3450" }, { "name": "CVE-2021-22939", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22939" }, { "name": "CVE-2019-19646", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19646" }, { "name": "CVE-2021-40366", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40366" }, { "name": "CVE-2021-41542", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41542" }, { "name": "CVE-2021-41541", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41541" }, { "name": "CVE-2021-22924", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22924" }, { "name": "CVE-2022-24309", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24309" }, { "name": "CVE-2020-8265", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8265" }, { "name": "CVE-2021-37713", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37713" }, { "name": "CVE-2021-22947", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22947" }, { "name": "CVE-2019-19925", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19925" }, { "name": "CVE-2021-22922", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22922" }, { "name": "CVE-2019-19924", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19924" }, { "name": "CVE-2021-32938", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32938" }, { "name": "CVE-2020-11656", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11656" }, { "name": "CVE-2022-26317", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26317" }, { "name": "CVE-2021-22946", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22946" }, { "name": "CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "name": "CVE-2020-8284", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8284" }, { "name": "CVE-2021-32940", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32940" }, { "name": "CVE-2021-3711", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3711" }, { "name": "CVE-2021-37208", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37208" }, { "name": "CVE-2021-32948", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32948" }, { "name": "CVE-2021-3449", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3449" }, { "name": "CVE-2022-26313", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26313" }, { "name": "CVE-2021-22921", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22921" }, { "name": "CVE-2021-25216", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25216" }, { "name": "CVE-2020-15358", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15358" }, { "name": "CVE-2021-43527", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43527" }, { "name": "CVE-2019-19242", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19242" }, { "name": "CVE-2021-22897", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22897" }, { "name": "CVE-2021-32803", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32803" }, { "name": "CVE-2021-25177", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25177" }, { "name": "CVE-2021-25175", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25175" }, { "name": "CVE-2021-22884", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22884" }, { "name": "CVE-2021-32952", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32952" }, { "name": "CVE-2019-19880", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19880" }, { "name": "CVE-2018-7160", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7160" }, { "name": "CVE-2021-32950", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32950" }, { "name": "CVE-2021-3672", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3672" }, { "name": "CVE-2021-31346", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31346" }, { "name": "CVE-2022-26314", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26314" }, { "name": "CVE-2021-31784", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31784" }, { "name": "CVE-2021-22883", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22883" }, { "name": "CVE-2020-8231", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8231" }, { "name": "CVE-2020-13631", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13631" }, { "name": "CVE-2021-25214", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25214" }, { "name": "CVE-2021-22931", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22931" }, { "name": "CVE-2021-31889", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31889" }, { "name": "CVE-2022-24408", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24408" }, { "name": "CVE-2021-42016", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42016" }, { "name": "CVE-2021-3712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3712" }, { "name": "CVE-2021-39134", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39134" }, { "name": "CVE-2019-19645", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19645" }, { "name": "CVE-2020-11655", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11655" }, { "name": "CVE-2020-8287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8287" }, { "name": "CVE-2021-22926", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22926" }, { "name": "CVE-2022-24661", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24661" }, { "name": "CVE-2021-22890", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22890" }, { "name": "CVE-2021-25219", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25219" }, { "name": "CVE-2021-23840", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23840" }, { "name": "CVE-2021-42018", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42018" }, { "name": "CVE-2021-22923", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22923" }, { "name": "CVE-2019-19923", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19923" }, { "name": "CVE-2021-39135", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39135" }, { "name": "CVE-2021-25176", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25176" }, { "name": "CVE-2021-31890", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31890" }, { "name": "CVE-2021-25178", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25178" }, { "name": "CVE-2021-22876", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22876" }, { "name": "CVE-2021-23362", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23362" }, { "name": "CVE-2019-19603", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19603" }, { "name": "CVE-2021-25217", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25217" }, { "name": "CVE-2021-25173", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25173" }, { "name": "CVE-2021-22945", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22945" }, { "name": "CVE-2022-25311", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25311" }, { "name": "CVE-2021-31344", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31344" }, { "name": "CVE-2021-37209", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37209" }, { "name": "CVE-2021-42019", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42019" }, { "name": "CVE-2020-8625", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8625" } ], "initial_release_date": "2022-03-08T00:00:00", "last_revision_date": "2022-03-08T00:00:00", "links": [], "reference": "CERTFR-2022-AVI-216", "revisions": [ { "description": "Version initiale", "revision_date": "2022-03-08T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "\u00c9l\u00e9vation de privil\u00e8ges" }, { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Injection de code indirecte \u00e0 distance (XSS)" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-166747 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-166747.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-252466 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-252466.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-562051 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-562051.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-223353 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-223353.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-337210 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-337210.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-148641 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-148641.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-389290 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-389290.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-764417 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-764417.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-256353 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-256353.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-703715 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-703715.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-594438 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-594438.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-415938 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-415938.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-134279 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-134279.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-155599 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-155599.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-406691 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-406691.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-250085 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-250085.html" } ] }
gsd-2021-41542
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2021-41542", "description": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "id": "GSD-2021-41542" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2021-41542" ], "details": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "id": "GSD-2021-41542", "modified": "2023-12-13T01:23:27.050961Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-41542", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Climatix POL909 (AWB module)", "version": { "version_data": [ { "version_value": "All versions \u003c V11.44" } ] } }, { "product_name": "Climatix POL909 (AWM module)", "version": { "version_data": [ { "version_value": "All versions \u003c V11.36" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:*", "cpe_name": [], "versionEndExcluding": "11.36", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:*", "cpe_name": [], "versionEndExcluding": "11.44", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:climatix_pol909:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-41542" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-79" } ] } ] }, "references": { "reference_data": [ { "name": "N/A", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 2.7 } }, "lastModifiedDate": "2022-03-11T18:33Z", "publishedDate": "2022-03-08T12:15Z" } } }
cnvd-2022-17788
Vulnerability from cnvd
用户可参考如下供应商提供的安全公告获得补丁信息: https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf
Name | ['Siemens Climatix POL909 (AWB module) < V11.44', 'Siemens Climatix POL909 (AWM module) < V11.36'] |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2021-41542" } }, "description": "Siemens Climatix AWB (Advanced Web and BACnet Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u8fde\u63a5\u5230BACnet IP\u7f51\u7edc\uff0c\u5e76\u5b9e\u73b0\u548c\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002Siemens Climatix AWM (Advanced Web Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u5b9e\u73b0\u5e76\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002\n\nSiemens Climatix POL909 (AWM and AWB)\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u53d1\u9001\u6076\u610fJavaScript\u4ee3\u7801\uff0c\u5bfc\u81f4\u52ab\u6301\u7528\u6237\u7684cookie/session\u4ee4\u724c\uff0c\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u6076\u610f\u7f51\u9875\uff0c\u5e76\u6267\u884c\u610f\u5916\u7684\u6d4f\u89c8\u5668\u64cd\u4f5c\u3002", "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2022-17788", "openTime": "2022-03-09", "patchDescription": "Siemens Climatix AWB (Advanced Web and BACnet Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u8fde\u63a5\u5230BACnet IP\u7f51\u7edc\uff0c\u5e76\u5b9e\u73b0\u548c\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002Siemens Climatix AWM (Advanced Web Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u5b9e\u73b0\u5e76\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002\r\n\r\nSiemens Climatix POL909 (AWM and AWB)\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u53d1\u9001\u6076\u610fJavaScript\u4ee3\u7801\uff0c\u5bfc\u81f4\u52ab\u6301\u7528\u6237\u7684cookie/session\u4ee4\u724c\uff0c\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u6076\u610f\u7f51\u9875\uff0c\u5e76\u6267\u884c\u610f\u5916\u7684\u6d4f\u89c8\u5668\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "Siemens Climatix POL909 (AWM and AWB)\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2022-17788\uff09\u7684\u8865\u4e01", "products": { "product": [ "Siemens Climatix POL909 (AWB module) \u003c V11.44", "Siemens Climatix POL909 (AWM module) \u003c V11.36" ] }, "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf", "serverity": "\u4e2d", "submitTime": "2022-03-09", "title": "Siemens Climatix POL909 (AWM and AWB)\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2022-17788\uff09" }
var-202203-0250
Vulnerability from variot
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. Siemens' Climatix POL909 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202203-0250", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "climatix pol909", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "11.44" }, { "model": "climatix pol909", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "11.36" }, { "model": "climatix pol909", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "climatix pol909", "scope": "eq", "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": "climatix pol909 firmware 11.36" }, { "model": "climatix pol909", "scope": "eq", "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "climatix pol909", "scope": "eq", "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": "climatix pol909 firmware 11.44" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "db": "NVD", "id": "CVE-2021-41542" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:*", "cpe_name": [], "versionEndExcluding": "11.36", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:*", "cpe_name": [], "versionEndExcluding": "11.44", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:climatix_pol909:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2021-41542" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Siemens reported these vulnerabilities to CISA.", "sources": [ { "db": "CNNVD", "id": "CNNVD-202203-762" } ], "trust": 0.6 }, "cve": "CVE-2021-41542", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "exploitabilityScore": 8.6, "impactScore": 2.9, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": true, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 4.3, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2021-41542", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitabilityScore": 2.8, "impactScore": 2.7, "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "None", "baseScore": 6.1, "baseSeverity": "Medium", "confidentialityImpact": "Low", "exploitabilityScore": null, "id": "CVE-2021-41542", "impactScore": null, "integrityImpact": "Low", "privilegesRequired": "None", "scope": "Changed", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2021-41542", "trust": 1.8, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-202203-762", "trust": 0.6, "value": "MEDIUM" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "db": "NVD", "id": "CVE-2021-41542" }, { "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. Siemens\u0027 Climatix POL909 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with", "sources": [ { "db": "NVD", "id": "CVE-2021-41542" }, { "db": "JVNDB", "id": "JVNDB-2021-018695" } ], "trust": 1.62 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2021-41542", "trust": 3.2 }, { "db": "SIEMENS", "id": "SSA-252466", "trust": 2.4 }, { "db": "ICS CERT", "id": "ICSA-22-069-07", "trust": 1.4 }, { "db": "JVN", "id": "JVNVU91709091", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2021-018695", "trust": 0.8 }, { "db": "CS-HELP", "id": "SB2022031007", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2022.1046", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202203-762", "trust": 0.6 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "db": "NVD", "id": "CVE-2021-41542" }, { "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "id": "VAR-202203-0250", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.14583333 }, "last_update_date": "2023-12-18T11:33:08.140000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Climatix POL909 Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=185251" } ], "sources": [ { "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-79", "trust": 1.0 }, { "problemtype": "Cross-site scripting (CWE-79) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "db": "NVD", "id": "CVE-2021-41542" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.4, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" }, { "trust": 0.8, "url": "https://jvn.jp/vu/jvnvu91709091/" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2021-41542" }, { "trust": 0.8, "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-07" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2022.1046" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2021-41542/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2022031007" }, { "trust": 0.6, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-069-07" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "db": "NVD", "id": "CVE-2021-41542" }, { "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "db": "NVD", "id": "CVE-2021-41542" }, { "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-07-05T00:00:00", "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "date": "2022-03-08T12:15:10.697000", "db": "NVD", "id": "CVE-2021-41542" }, { "date": "2022-03-08T00:00:00", "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-07-05T08:11:00", "db": "JVNDB", "id": "JVNDB-2021-018695" }, { "date": "2022-03-11T18:33:53.863000", "db": "NVD", "id": "CVE-2021-41542" }, { "date": "2022-03-14T00:00:00", "db": "CNNVD", "id": "CNNVD-202203-762" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202203-762" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Siemens\u0027 \u00a0Climatix\u00a0POL909\u00a0 Cross-site scripting vulnerability in firmware", "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-018695" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "XSS", "sources": [ { "db": "CNNVD", "id": "CNNVD-202203-762" } ], "trust": 0.6 } }
ghsa-fmgx-xc2g-vrvv
Vulnerability from github
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.
{ "affected": [], "aliases": [ "CVE-2021-41542" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-03-08T12:15:00Z", "severity": "MODERATE" }, "details": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "id": "GHSA-fmgx-xc2g-vrvv", "modified": "2022-03-17T00:02:50Z", "published": "2022-03-09T00:00:46Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41542" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "type": "CVSS_V3" } ] }
icsa-22-069-07
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "notes": [ { "category": "summary", "text": "Multiple vulnerabilities have been identified in the Climatix POL909 (AWM and AWB) that could allow an unauthenticated attacker to hijack and redirect users to a malicious webpage, or allow an authenticated attacker to access sensitive files.\n\nSiemens has released an update for the Climatix POL909 (AWM and AWB) and recommends to update to the latest version.", "title": "Summary" }, { "category": "general", "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-252466.json" }, { "category": "self", "summary": "SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-252466.txt" }, { "category": "self", "summary": "SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-07 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-069-07.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-07 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-07" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens Climatix POL909", "tracking": { "current_release_date": "2025-05-06T06:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-069-07", "initial_release_date": "2022-03-08T00:00:00.000000Z", "revision_history": [ { "date": "2022-03-08T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2025-05-06T06:00:00.000000Z", "legacy_version": "Revision", "number": "2", "summary": "Revision - Fixing typos" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cV11.44", "product": { "name": "Climatix POL909 (AWB module)", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Climatix POL909 (AWB module)" }, { "branches": [ { "category": "product_version_range", "name": "\u003cV11.36", "product": { "name": "Climatix POL909 (AWM module)", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Climatix POL909 (AWM module)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-41541", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "summary", "text": "The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2021-41541 - Climatix POL909 (AWB module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41541 - Climatix POL909 (AWM module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41541 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41541.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V11.44 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "category": "vendor_fix", "details": "Update to V11.36 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-41541" }, { "cve": "CVE-2021-41542", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "summary", "text": "The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2021-41542 - Climatix POL909 (AWB module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41542 - Climatix POL909 (AWM module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41542 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41542.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V11.44 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "category": "vendor_fix", "details": "Update to V11.36 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-41542" }, { "cve": "CVE-2021-41543", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "summary", "text": "The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2021-41543 - Climatix POL909 (AWB module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41543 - Climatix POL909 (AWM module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41543 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41543.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V11.44 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "category": "vendor_fix", "details": "Update to V11.36 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-41543" } ] }
ICSA-22-069-07
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "notes": [ { "category": "summary", "text": "Multiple vulnerabilities have been identified in the Climatix POL909 (AWM and AWB) that could allow an unauthenticated attacker to hijack and redirect users to a malicious webpage, or allow an authenticated attacker to access sensitive files.\n\nSiemens has released an update for the Climatix POL909 (AWM and AWB) and recommends to update to the latest version.", "title": "Summary" }, { "category": "general", "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-252466.json" }, { "category": "self", "summary": "SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-252466.txt" }, { "category": "self", "summary": "SSA-252466: Multiple Vulnerabilities in Climatix POL909 (AWM and AWB) - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-07 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-069-07.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-07 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-07" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens Climatix POL909", "tracking": { "current_release_date": "2025-05-06T06:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-069-07", "initial_release_date": "2022-03-08T00:00:00.000000Z", "revision_history": [ { "date": "2022-03-08T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2025-05-06T06:00:00.000000Z", "legacy_version": "Revision", "number": "2", "summary": "Revision - Fixing typos" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cV11.44", "product": { "name": "Climatix POL909 (AWB module)", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Climatix POL909 (AWB module)" }, { "branches": [ { "category": "product_version_range", "name": "\u003cV11.36", "product": { "name": "Climatix POL909 (AWM module)", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Climatix POL909 (AWM module)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-41541", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "summary", "text": "The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2021-41541 - Climatix POL909 (AWB module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41541 - Climatix POL909 (AWM module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41541 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41541.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V11.44 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "category": "vendor_fix", "details": "Update to V11.36 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-41541" }, { "cve": "CVE-2021-41542", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "summary", "text": "The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2021-41542 - Climatix POL909 (AWB module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41542 - Climatix POL909 (AWM module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41542 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41542.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V11.44 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "category": "vendor_fix", "details": "Update to V11.36 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-41542" }, { "cve": "CVE-2021-41543", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "summary", "text": "The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2021-41543 - Climatix POL909 (AWB module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41543 - Climatix POL909 (AWM module)", "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "summary": "CVE-2021-41543 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-41543.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V11.44 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" }, { "category": "vendor_fix", "details": "Update to V11.36 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109747351/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-41543" } ] }
fkie_cve-2021-41542
Vulnerability from fkie_nvd
URL | Tags | ||
---|---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf | Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf | Patch, Vendor Advisory |
Vendor | Product | Version | |
---|---|---|---|
siemens | climatix_pol909_firmware | * | |
siemens | climatix_pol909_firmware | * | |
siemens | climatix_pol909 | - |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_module:*:*:*", "matchCriteriaId": "8726D1E7-A120-4A48-958D-1767465AB1BA", "versionEndExcluding": "11.36", "vulnerable": true }, { "criteria": "cpe:2.3:o:siemens:climatix_pol909_firmware:*:*:*:*:advanced_web_and_bacnet_module:*:*:*", "matchCriteriaId": "820A1DB6-C7BC-45BB-B843-1B6F1D803BDA", "versionEndExcluding": "11.44", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:climatix_pol909:-:*:*:*:*:*:*:*", "matchCriteriaId": "256380A1-0197-4FED-AF9B-E05D59C7D1F1", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action." }, { "lang": "es", "value": "Se ha identificado una vulnerabilidad en Climatix POL909 (m\u00f3dulo AWB) (Todas las versiones anteriores a V11.44), Climatix POL909 (m\u00f3dulo AWM) (Todas las versiones anteriores a V11.36). La p\u00e1gina de administraci\u00f3n de usuarios de los dispositivos afectados es vulnerable a un ataque de tipo cross-site scripting (XSS). La vulnerabilidad permite a un atacante enviar c\u00f3digo JavaScript malicioso que podr\u00eda resultar en el secuestro de los tokens de cookies/sesi\u00f3n del usuario, redirigiendo al usuario a una p\u00e1gina web maliciosa y llevando a cabo una acci\u00f3n no deseada en el navegador" } ], "id": "CVE-2021-41542", "lastModified": "2024-11-21T06:26:22.987", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2022-03-08T12:15:10.697", "references": [ { "source": "productcert@siemens.com", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf" } ], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-79" } ], "source": "productcert@siemens.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-79" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.