OpenCVE

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote attacker to traverse directories on the system and download arbitrary files. By exploring active session IDs, the vulnerability could potentially be leveraged to escalate privileges to the administrator role.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Siemens	Cp-8031 Cp-8031 Firmware Cp-8050 Cp-8050 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:siemens:cp-8050_firmware:*:*:*:*:cpci85:*:*:*

cpe:2.3:h:siemens:cp-8050:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:siemens:cp-8031_firmware:*:*:*:*:cpci85:*:*:*

cpe:2.3:h:siemens:cp-8031:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/pdf/ssa-770890.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2023-10-10T10:21:26.106Z

Updated: 2024-08-02T19:30:24.061Z

Reserved: 2023-09-14T15:58:52.521Z

Link: CVE-2023-42796

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-10-10T11:15:12.150

Modified: 2024-11-21T08:23:10.387

Link: CVE-2023-42796

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:cp-8050_firmware:*:*:*:*:cpci85:*:*:*", "matchCriteriaId": "5DDCBDDD-3936-462A-A93A-696AAEBB4EBA", "versionEndExcluding": "05.11", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:cp-8050:-:*:*:*:*:*:*:*", "matchCriteriaId": "929EF3DE-C8E6-49DA-98C0-13AB4C966AA7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:cp-8031_firmware:*:*:*:*:cpci85:*:*:*", "matchCriteriaId": "36A1AC2A-A6D1-4C2F-9439-FA093EB6B44D", "versionEndExcluding": "05.11", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:cp-8031:-:*:*:*:*:*:*:*", "matchCriteriaId": "D24F9EDC-DA14-477D-B9C1-C9BF56E9B057", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11), CP-8050 MASTER MODULE (All versions < CPCI85 V05.11). The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint.\r\n\r\nThis could allow an authenticated remote attacker to traverse directories on the system and download arbitrary files. By exploring active session IDs, the vulnerability could potentially be leveraged to escalate privileges to the administrator role."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en: \nCP-8031 MASTER MODULE (Todas las versiones < CPCI85 V05.11), \nCP-8050 MASTER MODULE (Todas las versiones < CPCI85 V05.11). \nEl servidor web de los dispositivos afectados no sanitiza adecuadamente la entrada del usuario para el endpoint /sicweb-ajax/tmproot/. Esto podr\u00eda permitir que un atacante remoto autenticado atraviese directorios del sistema y descargue archivos arbitrarios. Al explorar los ID de sesi\u00f3n activos, la vulnerabilidad podr\u00eda aprovecharse para escalar privilegios al rol de administrador."}], "id": "CVE-2023-42796", "lastModified": "2024-11-21T08:23:10.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "productcert@siemens.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-10T11:15:12.150", "references": [{"source": "productcert@siemens.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770890.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770890.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "productcert@siemens.com", "type": "Secondary"}]}