SSA-484086

csafDEsiemens_psirt

SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1

view advisory published 2022-06-14

SINEMA Remote Connect Server is affected by multiple vulnerabilities, including - A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) - Several authentication bypass, privilege escalation and integrity check vulnerabilities (CVE-2022-32251 through -32261) - A command injection vulnerability in the file upload service (CVE-2022-32262) - A chosen-plaintext attack against HTTP over TLS ("BREACH", CVE-2022-27221) - Information disclosure vulnerabilities in the curl component (CVE-2021-22924 through -22925) - Several vulnerabilities in the libexpat library, that could be exploited when the server is parsing untrusted XML files (CVE-2021-45960, CVE-2021-46143, CVE-2022-22822 through -22827, CVE-2022-23852, CVE-2022-23990, CVE-2022-25235 through -25236, CVE-2022-25313 through -25315. Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to the latest version. Note that the update also contains additional fixes for vulnerabilities documented in Siemens Security Advisories SSA-244969, SSA-539476, SSA-685781 and SSA-712929.

01

describes (29)

Related CVEs.

IDseverity exploitable
CVE-2022-32262UScritical9.8—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command inje…
CVE-2022-32261UShigh7.5—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow…
CVE-2022-32259USmedium6.5—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The system images for installation or update of the affected application contain unit tes…
CVE-2022-32258UShigh7.5—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to import device configura…
CVE-2022-32256USmedium6.5—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for s…
CVE-2022-32255USmedium5.3—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for s…
CVE-2022-32254UShigh7.5—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given…
CVE-2022-32253UShigh7.5—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to…
CVE-2022-32252UShigh7.8OT elevated—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without vali…
CVE-2022-32251UScritical9.8OT elevated—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles an…
CVE-2022-29034USmedium6.1—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not…
CVE-2022-27221USmedium5.9—
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing le…
CVE-2022-25315UScritical9.8Exploit
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25314UShigh7.5Exploit
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-25313USmedium6.5Exploit
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2022-25236UScritical9.8Exploit
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25235UScritical9.8Exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
CVE-2022-23990UShigh7.5Exploit
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVE-2022-23852UScritical9.8Exploit
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
CVE-2022-22827UShigh8.8—
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
showing 20 of 29
02

references

External citations — patches, advisories, analysis.

03

remediations (29)

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan