{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-43398", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "dateUpdated": "2024-08-03T13:32:58.148Z", "dateReserved": "2022-10-18T00:00:00", "datePublished": "2022-11-08T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2024-01-09T09:57:13.900Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session."}], "affected": [{"vendor": "Siemens", "product": "POWER METER SICAM Q100", "versions": [{"version": "All versions < V2.50", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "POWER METER SICAM Q100", "versions": [{"version": "All versions < V2.50", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "POWER METER SICAM Q100", "versions": [{"version": "All versions < V2.50", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "POWER METER SICAM Q100", "versions": [{"version": "All versions < V2.50", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-384", "description": "CWE-384: Session Fixation", "type": "CWE"}]}], "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:58.148Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf", "tags": ["x_transferred"]}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:7kg9501-0aa01-2aa1:-:*:*:*:*:*:*:*", "matchCriteriaId": "275E9296-AACA-4F3B-B8FA-D52A59E729DE", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:7kg9501-0aa01-2aa1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "821380FC-8F3A-4437-94FF-FB95D9F187D0", "versionEndExcluding": "2.50", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:7kg9501-0aa31-2aa1:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC260D4F-53BD-433C-AE8F-FA2FA47BC921", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:7kg9501-0aa31-2aa1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEE155DF-AB9B-4A85-A845-AF1B51B05833", "versionEndExcluding": "2.50", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en la familia POWER METER SICAM Q200 (Todas las versiones &lt; V2.70). Los dispositivos afectados no renuevan la cookie de sesi\u00f3n despu\u00e9s de iniciar/cerrar sesi\u00f3n y tambi\u00e9n aceptan cookies de sesi\u00f3n definidas por el usuario. Un atacante podr\u00eda sobrescribir la cookie de sesi\u00f3n almacenada de un usuario. Despu\u00e9s de que la v\u00edctima inicia sesi\u00f3n, el atacante obtiene acceso a la cuenta del usuario a trav\u00e9s de la sesi\u00f3n activada."}], "id": "CVE-2022-43398", "lastModified": "2024-01-09T10:15:14.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "productcert@siemens.com", "type": "Secondary"}]}, "published": "2022-11-08T11:15:11.940", "references": [{"source": "productcert@siemens.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf"}, {"source": "productcert@siemens.com", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-384"}], "source": "productcert@siemens.com", "type": "Secondary"}]}

{}