SSA-995338

SSA-995338: Multiple Vulnerabilities in COMOS Web

Advisory ansehen veröffentlicht 2022-01-11

Multiple vulnerabilities were identified in the web components of COMOS that could allow an attacker to conduct code injections, store data in undesired locations, execute arbitrary SQL statements, and run cross-site request forgery attacks. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

beschreibt (5)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-37194US	high7.5	0.85% (58th)	—	2022-02-09
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10…
CVE-2021-37198US	high8.8	0.36% (30th)	—	2022-01-11
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10…
CVE-2021-37197US	high8.8	0.82% (57th)	—	2022-01-11
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10…
CVE-2021-37196US	medium6.5	0.78% (56th)	—	2022-01-11
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10…
CVE-2021-37195US	medium6.1	0.51% (43rd)	—	2022-01-11
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

Behebungen (31)

MitigationCOMOS V10.2
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.2
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.2
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.2
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.2
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.3
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.3
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.3
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.3
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.3
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.4
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.4
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.4
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.4
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
MitigationCOMOS V10.4
CVE-2021-37196 can be mitigated in all versions by making the root directory of the web server read only
Kein Fix geplantCOMOS V10.2
Currently no fix is planned
Kein Fix geplantCOMOS V10.2
Currently no fix is planned
Kein Fix geplantCOMOS V10.2
Currently no fix is planned
Kein Fix geplantCOMOS V10.2
Currently no fix is planned
Kein Fix geplantCOMOS V10.2
Currently no fix is planned
Kein Fix geplantCOMOS V10.3
Currently no fix is planned
BehobenCOMOS V10.3
Update to V10.3.3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808862/
BehobenCOMOS V10.3
Update to V10.3.3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808862/
BehobenCOMOS V10.3
Update to V10.3.3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808862/
BehobenCOMOS V10.3
Update to V10.3.3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808862/
BehobenCOMOS V10.3
Update to V10.3.3.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808862/
BehobenCOMOS V10.4
Update to V10.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805632/
BehobenCOMOS V10.4
Update to V10.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805632/
BehobenCOMOS V10.4
Update to V10.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805632/
BehobenCOMOS V10.4
Update to V10.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805632/
BehobenCOMOS V10.4
Update to V10.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805632/

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan