Lucene search

[email protected]CVE-2023-46281

HistoryDec 12, 2023 - 12:15 p.m.

CVE-2023-46281

2023-12-1212:15:13

CWE-942

[email protected]

web.nvd.nist.gov

cve

2023

46281

vulnerability

opcenter quality

simatic pcs neo

sinumerik integrate runmyhmi

totally integrated automation portal

tia portal

cors policy

attacker

security

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.2%

JSON

A vulnerability has been identified in Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 7), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.

Affected configurations

NVD

Node

siemensopcenter_qualityMatch-

siemenssimatic_pcs_neoRange<4.1

siemenssinumerik_integrate_runmyhmi_\/automotiveMatch-

siemenstotally_integrated_automation_portalRange14.0–15

siemenstotally_integrated_automation_portalRange15–16

siemenstotally_integrated_automation_portalRange16–17

siemenstotally_integrated_automation_portalRange17–18

siemenstotally_integrated_automation_portalMatch-

siemenstotally_integrated_automation_portalMatch18

siemenstotally_integrated_automation_portalMatch18update_1

CPENameOperatorVersion
siemens:opcenter_qualitysiemens opcenter qualityeq-
siemens:simatic_pcs_neosiemens simatic pcs neolt4.1
siemens:sinumerik_integrate_runmyhmi_\/automotivesiemens sinumerik integrate runmyhmi /automotiveeq-
siemens:totally_integrated_automation_portalsiemens totally integrated automation portallt15
siemens:totally_integrated_automation_portalsiemens totally integrated automation portallt16
siemens:totally_integrated_automation_portalsiemens totally integrated automation portallt17
siemens:totally_integrated_automation_portalsiemens totally integrated automation portallt18
siemens:totally_integrated_automation_portalsiemens totally integrated automation portaleq-

CPE	Name	Operator	Version
siemens:opcenter_quality	siemens opcenter quality	eq	-
siemens:simatic_pcs_neo	siemens simatic pcs neo	lt	4.1
siemens:sinumerik_integrate_runmyhmi_\/automotive	siemens sinumerik integrate runmyhmi /automotive	eq	-
siemens:totally_integrated_automation_portal	siemens totally integrated automation portal	lt	15
siemens:totally_integrated_automation_portal	siemens totally integrated automation portal	lt	16
siemens:totally_integrated_automation_portal	siemens totally integrated automation portal	lt	17
siemens:totally_integrated_automation_portal	siemens totally integrated automation portal	lt	18
siemens:totally_integrated_automation_portal	siemens totally integrated automation portal	eq	-

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "Opcenter Quality",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V2312",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "SIMATIC PCS neo",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "SINEC NMS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V2.0 SP1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Totally Integrated Automation Portal (TIA Portal) V14",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Totally Integrated Automation Portal (TIA Portal) V15.1",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Totally Integrated Automation Portal (TIA Portal) V16",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Totally Integrated Automation Portal (TIA Portal) V17",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V17 Update 7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Totally Integrated Automation Portal (TIA Portal) V18",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V18 Update 3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]