CVE-2024-42345

2024-09-1010:15:12

CWE-384

[email protected]

web.nvd.nist.gov

vulnerability

sinema remote connect server

improper handling

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

Percentile

14.7%

JSON

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session establishment and invalidation. This could allow a remote attacker to circumvent the additional multi factor authentication for user session establishment.

Affected configurations

Nvd

Node

siemenssinema_remote_connect_serverRange<3.2

siemenssinema_remote_connect_serverMatch3.2-

siemenssinema_remote_connect_serverMatch3.2hf1

siemenssinema_remote_connect_serverMatch3.2sp1

VendorProductVersionCPE
siemenssinema_remote_connect_server*cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
siemenssinema_remote_connect_server3.2cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-:*:*:*:*:*:*
siemenssinema_remote_connect_server3.2cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1:*:*:*:*:*:*
siemenssinema_remote_connect_server3.2cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	sinema_remote_connect_server	*	cpe:2.3:a:siemens:sinema_remote_connect_server::::::::
siemens	sinema_remote_connect_server	3.2	cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-::::::
siemens	sinema_remote_connect_server	3.2	cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:hf1::::::
siemens	sinema_remote_connect_server	3.2	cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:sp1::::::