SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14
SINEMA Server V14 improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with SYSTEM privileges on the application server. Siemens recommends to migrate to its successor product SINEC NMS V2.0 or later. Siemens recommends to apply specific countermeasures for products where updates are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-35796US | critical9.0 | — | ||
A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - CSAF Versionself
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - HTML Versionself
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - PDF Versionself
- SSA-594373: Cross-Site-Scripting (XSS) Vulnerability in SINEMA Server V14 - TXT Versionself
Behebungen (2)
- MitigationSINEMA Server V14
Restrict access to the SNMP servers in the device network
- Kein Fix geplantSINEMA Server V14
Currently no fix is planned
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan