Lucene search

[email protected]CVE-2022-36325

HistoryAug 10, 2022 - 12:15 p.m.

CVE-2022-36325

2022-08-1012:15:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2022-36325

security

code injection

xss

web interface

vulnerability

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:M/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

30.1%

JSON

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.

CPENameOperatorVersion
siemens:scalance_m-800_firmwaresiemens scalance m-800 firmwareeq*
siemens:scalance_s615_firmwaresiemens scalance s615 firmwareeq*
siemens:scalance_sc-600_firmwaresiemens scalance sc-600 firmwarelt2.3.1
siemens:scalance_sc622-2c_firmwaresiemens scalance sc622-2c firmwarelt2.3.1
siemens:scalance_sc632-2c_firmwaresiemens scalance sc632-2c firmwarelt2.3.1
siemens:scalance_sc636-2c_firmwaresiemens scalance sc636-2c firmwarelt2.3.1
siemens:scalance_sc642-2c_firmwaresiemens scalance sc642-2c firmwarelt2.3.1
siemens:scalance_sc646-2c_firmwaresiemens scalance sc646-2c firmwarelt2.3.1
siemens:scalance_w700_ieee_802.11ax_firmwaresiemens scalance w700 ieee 802.11ax firmwareeq*
siemens:scalance_w700_ieee_802.11n_firmwaresiemens scalance w700 ieee 802.11n firmwareeq*

CPE	Name	Operator	Version
siemens:scalance_m-800_firmware	siemens scalance m-800 firmware	eq	*
siemens:scalance_s615_firmware	siemens scalance s615 firmware	eq	*
siemens:scalance_sc-600_firmware	siemens scalance sc-600 firmware	lt	2.3.1
siemens:scalance_sc622-2c_firmware	siemens scalance sc622-2c firmware	lt	2.3.1
siemens:scalance_sc632-2c_firmware	siemens scalance sc632-2c firmware	lt	2.3.1
siemens:scalance_sc636-2c_firmware	siemens scalance sc636-2c firmware	lt	2.3.1
siemens:scalance_sc642-2c_firmware	siemens scalance sc642-2c firmware	lt	2.3.1
siemens:scalance_sc646-2c_firmware	siemens scalance sc646-2c firmware	lt	2.3.1
siemens:scalance_w700_ieee_802.11ax_firmware	siemens scalance w700 ieee 802.11ax firmware	eq	*
siemens:scalance_w700_ieee_802.11n_firmware	siemens scalance w700 ieee 802.11n firmware	eq	*

Rows per page:

1-10 of 901

References

cert-portal.siemens.com/productcert/pdf/ssa-710008.pdf

Social References

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:M/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

30.1%

JSON

Related for CVE-2022-36325

cnvd1 cvelist1 prion1 nessus1 ics1