SSA-478960

csafDEsiemens_psirt

SSA-478960: Missing CSRF Protection in the Web Server Login Page of Industrial Controllers

view advisory published 2022-11-08

The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2022-30694US——
The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other us…
02

references

External citations — patches, advisories, analysis.

03

remediations (308)

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan