This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Siemens | SIMATIC WinCC OA V3.15 | unknown |
|
||||||
| Siemens | SIMATIC WinCC OA V3.16 | unknown |
|
||||||
| Siemens | SIMATIC WinCC OA V3.17 | unknown |
|
||||||
| Siemens | SIMATIC WinCC OA V3.18 | unknown |
|
Configuration 1 [-]
|
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-47663 | A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script). |
Mon, 21 Apr 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: siemens
Published:
Updated: 2025-04-21T13:43:45.574Z
Reserved: 2022-11-04T00:00:00.000Z
Link: CVE-2022-44731
Vulnrichment
Updated: 2024-08-03T14:01:31.331Z
NVD
Status : Modified
Published: 2022-12-13T16:15:24.543
Modified: 2024-11-21T07:28:23.160
Link: CVE-2022-44731
Redhat
No data.
OpenCVE Enrichment
No data.