SSA-640968

csafDEsiemens_psirt

SSA-640968: Untrusted Search Path Vulnerability in TIA Project-Server formerly known as TIA Multiuser Server

Advisory ansehen veröffentlicht 2023-02-14

TIA Project-Server formerly known as TIA Multiuser Server contains an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2022-35868US——
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1),…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (10)

  • MitigationTIA Multiuser Server V14

    Make sure that the directory that is set as working directory when starting the TIA Project-Server or TIA Multiuser Server does not contain untrusted files.

  • MitigationTIA Multiuser Server V15

    Make sure that the directory that is set as working directory when starting the TIA Project-Server or TIA Multiuser Server does not contain untrusted files.

  • MitigationTIA Project-Server

    Make sure that the directory that is set as working directory when starting the TIA Project-Server or TIA Multiuser Server does not contain untrusted files.

  • MitigationTIA Project-Server V16

    Make sure that the directory that is set as working directory when starting the TIA Project-Server or TIA Multiuser Server does not contain untrusted files.

  • MitigationTIA Project-Server V17

    Make sure that the directory that is set as working directory when starting the TIA Project-Server or TIA Multiuser Server does not contain untrusted files.

  • Kein Fix geplantTIA Multiuser Server V14

    Currently no fix is planned

  • Kein Fix geplantTIA Project-Server V16

    Currently no fix is planned

  • BehobenTIA Multiuser Server V15

    Update to V15.1 Update 8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763893/
  • BehobenTIA Project-Server

    Update to V1.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810588/
  • BehobenTIA Project-Server V17

    Update to V17 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109800915/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan