cnvd-2022-17789
Vulnerability from cnvd
Title
Siemens Climatix POL909 (AWM and AWB)跨站脚本漏洞
Description
Siemens Climatix AWB (Advanced Web and BACnet Module, POL909) 使Climatix 600解决方案的用户能够连接到BACnet IP网络，并实现和加载客户网页和功能。Siemens Climatix AWM (Advanced Web Module, POL909) 使Climatix 600解决方案的用户能够实现并加载客户网页和功能。 Siemens Climatix POL909 (AWM and AWB)存在跨站脚本漏洞，攻击者可利用漏洞发送恶意JavaScript代码，导致劫持用户的cookie/session令牌，将用户重定向到恶意网页，并执行意外的浏览器操作。
Severity
中
Patch Name
Siemens Climatix POL909 (AWM and AWB)跨站脚本漏洞的补丁
Patch Description
Siemens Climatix AWB (Advanced Web and BACnet Module, POL909) 使Climatix 600解决方案的用户能够连接到BACnet IP网络，并实现和加载客户网页和功能。Siemens Climatix AWM (Advanced Web Module, POL909) 使Climatix 600解决方案的用户能够实现并加载客户网页和功能。 Siemens Climatix POL909 (AWM and AWB)存在跨站脚本漏洞，攻击者可利用漏洞发送恶意JavaScript代码，导致劫持用户的cookie/session令牌，将用户重定向到恶意网页，并执行意外的浏览器操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf

Reference
https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf
Impacted products
Name
['Siemens Climatix POL909 (AWB module) < V11.44', 'Siemens Climatix POL909 (AWM module) < V11.36']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-41541"
    }
  },
  "description": "Siemens Climatix AWB (Advanced Web and BACnet Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u8fde\u63a5\u5230BACnet IP\u7f51\u7edc\uff0c\u5e76\u5b9e\u73b0\u548c\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002Siemens Climatix AWM (Advanced Web Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u5b9e\u73b0\u5e76\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002\n\nSiemens Climatix POL909 (AWM and AWB)\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u53d1\u9001\u6076\u610fJavaScript\u4ee3\u7801\uff0c\u5bfc\u81f4\u52ab\u6301\u7528\u6237\u7684cookie/session\u4ee4\u724c\uff0c\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u6076\u610f\u7f51\u9875\uff0c\u5e76\u6267\u884c\u610f\u5916\u7684\u6d4f\u89c8\u5668\u64cd\u4f5c\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-17789",
  "openTime": "2022-03-02",
  "patchDescription": "Siemens Climatix AWB (Advanced Web and BACnet Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u8fde\u63a5\u5230BACnet IP\u7f51\u7edc\uff0c\u5e76\u5b9e\u73b0\u548c\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002Siemens Climatix AWM (Advanced Web Module, POL909) \u4f7fClimatix 600\u89e3\u51b3\u65b9\u6848\u7684\u7528\u6237\u80fd\u591f\u5b9e\u73b0\u5e76\u52a0\u8f7d\u5ba2\u6237\u7f51\u9875\u548c\u529f\u80fd\u3002\r\n\r\nSiemens Climatix POL909 (AWM and AWB)\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u53d1\u9001\u6076\u610fJavaScript\u4ee3\u7801\uff0c\u5bfc\u81f4\u52ab\u6301\u7528\u6237\u7684cookie/session\u4ee4\u724c\uff0c\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u6076\u610f\u7f51\u9875\uff0c\u5e76\u6267\u884c\u610f\u5916\u7684\u6d4f\u89c8\u5668\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens Climatix POL909 (AWM and AWB)\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens Climatix POL909 (AWB module) \u003c V11.44",
      "Siemens Climatix POL909 (AWM module) \u003c V11.36"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf",
  "serverity": "\u4e2d",
  "submitTime": "2022-03-09",
  "title": "Siemens Climatix POL909 (AWM and AWB)\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.