CVE-2020-23064

mediumrejectedpriority · track · 0DERUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 6.1 · medium

Is it mine?

18 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-11023. Reason: This candidate is a duplicate of CVE-2020-11023. Notes: All CVE users should reference CVE-2020-11023 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSINEMA Remote Connect Serversiemens_psirt
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811169/
FixedSINEMA Remote Connect Servercisa_csaf_ot
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811169/

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.16.1mediumAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79USCWE-79USCWE-79US

affected products (18)

Products and version ranges known to be affected.

IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM Spectrum Scaleall versionscert_bundDEcpe:/a:ibm:spectrum_scale:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
IBM QRadar SIEM< 7.5.0 UP9cert_bundDE
Open Source jQuery< 3.5.0cert_bundDE
SINEMA Remote Connect Serverall versionscisa_csaf_otUS
Siemens SINEMA Remote Connect Server< V3.1cisa_csaf_otUS
Red Hat Inc. OpenShift Container Platform≤ 4fstec_bduRU
Red Hat Inc. Red Hat Discoveryall versionsfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat Inc. Red Hat Satellite≤ 6fstec_bduRU
Red Hat Inc. Red Hat Storage≤ 3fstec_bduRU
The jQuery Foundation jQuery2.2.0 → 3.5.0fstec_bduRU
Maven org.webjars.npm:jquery1.0.3 → 3.5.0osvUSpkg:maven/org.webjars.npm/jquery
NuGet jQuery1.0.3 → 3.5.0osvUSpkg:nuget/jQuery
RubyGems jquery-rails< 4.4.0osvUSpkg:gem/jquery-rails
npm jquery1.0.3 → 3.5.0osvUSpkg:npm/jquery
Siemens SINEMA Remote Connect Server< V3.1siemens_psirtDE

advisories (4)

Vendor and ecosystem advisories describing this.

SSA-576771SSA-576771: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.22024-03-12csaf · siemens_psirtDE
SINEMA Remote Connect Server before V3.2 is affected by multiple vulnerabilities. Siemens has released updates for the affected products and recommends to update to the latest versions.
WID-SEC-W-2023-1572jQuery: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2023-06-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
GHSA-257q-pv89-v3xvDuplicate Advisory: jQuery Cross Site Scripting vulnerability2023-06-26ghsa · osvUS
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of [GHSA-jpcq-cgw6-v4j6](https://github.com/advisories/GHSA-jpcq-cgw6-v4j6). This link is maintained to preserve external references. ## Original Description Cross Site Scripting vulnerability in jQuery v.2.2.0 until v.3.5.0 allows a remote attacker to execute arbitrary code via the `<options>` element.
ICSA-24-074-03Siemens SINEMA Remote Connect Server2024-03-12icsa · cisa_csaf_otUS
SINEMA Remote Connect Server before V3.2 is affected by multiple vulnerabilities. Siemens has released updates for the affected products and recommends to update to the latest versions.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot osv siemens_psirt NVD CVE.org MITRE

published 2023-06-26modified 2024-05-15

references (4) cnnvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan