CVE-2022-29034

🗓️ 14 Jun 2022 09:21:45Reported by siemensType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 107 Views🌐 WEB

A vulnerability in SINEMA Remote Connect Server allows injection of JavaScript code

Reporter	Title	Published	Views	Family All 13
0day.today	SIEMENS-SINEMA Remote Connect 3.0.1.0-01.01.00.02 Cross Site Scripting Vulnerability	21 Jun 202200:00	–	zdt
ATTACKERKB	CVE-2022-29034	14 Jun 202210:15	–	attackerkb
CNNVD	Siemens SINEMA Remote Connect Server 跨站脚本漏洞	14 Jun 202200:00	–	cnnvd
CNVD	Siemens SINEMA Remote Connect Server Cross-Site Scripting Vulnerability (CNVD-2022-45230)	15 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-29034	14 Jun 202209:21	–	cvelist
EUVD	EUVD-2022-33464	3 Oct 202520:07	–	euvd
ICS	Siemens OpenSSL Affecting Industrial Products	14 Jun 202200:00	–	ics
NVD	CVE-2022-29034	14 Jun 202210:15	–	nvd
Packet Storm	SIEMENS-SINEMA Remote Connect 3.0.1.0-01.01.00.02 Cross Site Scripting	20 Jun 202200:00	–	packetstorm
Prion	Cross site scripting	14 Jun 202210:15	–	prion

NVD

Node

siemens sinema_remote_connect_serverRange<3.1

[
  {
    "vendor": "Siemens",
    "product": "SINEMA Remote Connect Server",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V3.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-484086.html
packetstormsecurity	www.packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html
seclists	www.seclists.org/fulldisclosure/2022/Jun/35

Parameter	Position	Path	Description	CWE
address	request body	/services/syslog_client_settings	Reflected cross-site scripting (XSS) via address parameter in syslog client settings. An error message reflects user-supplied input, allowing injected JavaScript in the browser.	CWE-79