SSA-035466

csafDEsiemens_psirt

SSA-035466: Incorrect Permission Assignment in SICAM PAS/PQS

view advisory published 2023-10-10

SICAM PAS/PQS is affected by insecure permission assignments in application folders that could allow an authenticated local attacker to read and modify configuration data or to escalate privileges. Siemens has released a new version for SICAM PAS/PQS and recommends to update to the latest version. Siemens has also released a security patch that can be applied to previous versions to fix the permissions of the impacted folders. See also chapter Additional Information.

01

describes (2)

Related CVEs.

IDseverity exploitable
CVE-2023-45205US——
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permission…
CVE-2023-38640USmedium4.4—
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permission…
02

references

External citations — patches, advisories, analysis.

03

remediations (4)

  • MitigationSICAM PAS/PQS

    Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts on the server

  • MitigationSICAM PAS/PQS

    Ensure that only trusted persons have access to the system and avoid the configuration of additional local accounts on the server

  • FixedSICAM PAS/PQS

    Install the Security Patch (available at https://support.industry.siemens.com/cs/ww/ en/view/109824392/), which can be applied to versions V8.00 to V8.21

  • FixedSICAM PAS/PQS

    Install the Security Patch (available at https://support.industry.siemens.com/cs/ww/ en/view/109824392/), which can be applied to versions V8.00 to V8.21

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan