SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14
SINEMA Server V14 improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with SYSTEM privileges on the application server. Siemens recommends to migrate to its successor product SINEC NMS V2.0 or later. Siemens recommends to apply specific countermeasures for products where updates are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-35796US | critical9.0 | — | ||
A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devi… | ||||
references
External citations — patches, advisories, analysis.
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - CSAF Versionself
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - HTML Versionself
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - PDF Versionself
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - TXT Versionself
remediations (2)
- MitigationSINEMA Server V14
Restrict access to the SNMP servers in the device network
- No fix plannedSINEMA Server V14
Currently no fix is planned
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan