Vulnerability-Lookup

CNVD-2020-51241

Vulnerability from cnvd - Published: 2020-09-10

Title

多款Siemens产品验证错误漏洞

Description

Siemens SIMATIC WinCC OA（Open Architecture）是德国西门子（Siemens）公司的一套SCADA系统，也是HMI系列的一个组成部分。该系统主要适用于轨道交通、楼宇自动化和公共电力供应等行业。Information Server用于报告和可视化存储在Process Historian中的过程数据。SINEC INS是基于Web的应用程序，将各种网络服务组合在一个工具中。多款Siemens产品存在安全漏洞。攻击者可利用漏洞更改或创建许可证文件。

Severity

高

Patch Name

多款Siemens产品验证错误漏洞的补丁

Patch Description

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf

Reference

https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf

Impacted products

Name
['Siemens SINEC INS', 'SIEMENS SINEMA Remote Connect']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-14519"
    }
  },
  "description": "Siemens SIMATIC WinCC OA\uff08Open Architecture\uff09\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u5957SCADA\u7cfb\u7edf\uff0c\u4e5f\u662fHMI\u7cfb\u5217\u7684\u4e00\u4e2a\u7ec4\u6210\u90e8\u5206\u3002\u8be5\u7cfb\u7edf\u4e3b\u8981\u9002\u7528\u4e8e\u8f68\u9053\u4ea4\u901a\u3001\u697c\u5b87\u81ea\u52a8\u5316\u548c\u516c\u5171\u7535\u529b\u4f9b\u5e94\u7b49\u884c\u4e1a\u3002Information Server\u7528\u4e8e\u62a5\u544a\u548c\u53ef\u89c6\u5316\u5b58\u50a8\u5728Process Historian\u4e2d\u7684\u8fc7\u7a0b\u6570\u636e\u3002SINEC INS\u662f\u57fa\u4e8eWeb\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u5c06\u5404\u79cd\u7f51\u7edc\u670d\u52a1\u7ec4\u5408\u5728\u4e00\u4e2a\u5de5\u5177\u4e2d\u3002\n\n\u591a\u6b3eSiemens\u4ea7\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u66f4\u6539\u6216\u521b\u5efa\u8bb8\u53ef\u8bc1\u6587\u4ef6\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-51241",
  "openTime": "2020-09-10",
  "patchDescription": "Siemens SIMATIC WinCC OA\uff08Open Architecture\uff09\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u5957SCADA\u7cfb\u7edf\uff0c\u4e5f\u662fHMI\u7cfb\u5217\u7684\u4e00\u4e2a\u7ec4\u6210\u90e8\u5206\u3002\u8be5\u7cfb\u7edf\u4e3b\u8981\u9002\u7528\u4e8e\u8f68\u9053\u4ea4\u901a\u3001\u697c\u5b87\u81ea\u52a8\u5316\u548c\u516c\u5171\u7535\u529b\u4f9b\u5e94\u7b49\u884c\u4e1a\u3002Information Server\u7528\u4e8e\u62a5\u544a\u548c\u53ef\u89c6\u5316\u5b58\u50a8\u5728Process Historian\u4e2d\u7684\u8fc7\u7a0b\u6570\u636e\u3002SINEC INS\u662f\u57fa\u4e8eWeb\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u5c06\u5404\u79cd\u7f51\u7edc\u670d\u52a1\u7ec4\u5408\u5728\u4e00\u4e2a\u5de5\u5177\u4e2d\u3002\r\n\r\n\u591a\u6b3eSiemens\u4ea7\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u66f4\u6539\u6216\u521b\u5efa\u8bb8\u53ef\u8bc1\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSiemens\u4ea7\u54c1\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SINEC INS",
      "SIEMENS SINEMA Remote Connect"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2020-09-09",
  "title": "\u591a\u6b3eSiemens\u4ea7\u54c1\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2020-14519 (GCVE-0-2020-14519)

Vulnerability from cvelistv5 – Published: 2020-09-16 19:44 – Updated: 2024-08-04 12:46

Summary

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.

Severity

No CVSS data available.

CWE

CWE-346 - ORIGIN VALIDATION ERROR CWE-346

Assigner

icscert icscert root

References

1 reference

URL	Tags
https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	CodeMeter	Affected: All versions prior to 7.00, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:34.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CodeMeter",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 7.00, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "ORIGIN VALIDATION ERROR CWE-346",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-16T19:44:16.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2020-14519",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CodeMeter",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to 7.00, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "ORIGIN VALIDATION ERROR CWE-346"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01",
              "refsource": "MISC",
              "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2020-14519",
    "datePublished": "2020-09-16T19:44:16.000Z",
    "dateReserved": "2020-06-19T00:00:00.000Z",
    "dateUpdated": "2024-08-04T12:46:34.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.