CVE-2024-22045

A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. This information is also available via the web interface of the product.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-653855.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:sinema_remote_connect_client::::::::
	cpe:2.3:a:siemens:sinema_remote_connect_client:3.1:-::::::

History

25 Mar 2024, 16:24

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad en SINEMA Remote Connect Client (todas las versiones < V3.1 SP1). El producto coloca información confidencial en archivos o directorios a los que pueden acceder los actores a quienes se les permite tener acceso a los archivos, pero no a la información confidencial. Esta información también está disponible a través de la interfaz web del producto.
CWE		NVD-CWE-Other
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-653855.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-653855.html - Patch, Vendor Advisory
CPE		cpe:2.3:a:siemens:sinema_remote_connect_client:3.1:-:::::: cpe:2.3:a:siemens:sinema_remote_connect_client::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~7.6~~	v2 : unknown v3 : 6.5
First Time		Siemens sinema Remote Connect Client Siemens

12 Mar 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-12 11:15

Updated : 2024-03-25 16:24

NVD link : CVE-2024-22045

Mitre link : CVE-2024-22045

CVE.ORG link : CVE-2024-22045

JSON object : View

Products Affected

siemens

sinema_remote_connect_client

CWE

NVD-CWE-Other CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

{"id": "CVE-2024-22045", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"safety": "NOT DEFINED", "version": "4.0", "recovery": "NOT DEFINED", "baseScore": 0.0, "automatable": "NOT DEFINED ", "attackVector": "NETWORK", "baseSeverity": "NONE", "valueDensity": "NOT DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:H/IR:H/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT DEFINED", "providerUrgency": "NOT DEFINED ", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT DEFINED", "integrityRequirements": "HIGH", "modifiedUserInteraction": "NOT DEFINED", "modifiedAttackComplexity": "NOT DEFINED", "Availability Requirements": "NOT DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT DEFINED", "modifiedPrivilegesRequired": "NOT DEFINED", "confidentialityRequirements": "HIGH", "vulnerabilityResponseEffort": "NOT DEFINED ", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "LOW", "vulnerableSystemConfidentiality": "LOW", "modifiedSubsequentSystemIntegrity": "NOT DEFINED", "modifiedVulnerableSystemIntegrity": "NOT DEFINED", "modifiedSubsequentSystemAvailability": "NOT DEFINED", "Modified Vulnerable System Availability": "NOT DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT DEFINED"}, "impactScore": 0.0, "exploitabilityScore": 0.0}]}, "published": "2024-03-12T11:15:49.390", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-653855.html", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-538"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. This information is also available via the web interface of the product."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SINEMA Remote Connect Client (todas las versiones < V3.1 SP1). El producto coloca informaci\u00f3n confidencial en archivos o directorios a los que pueden acceder los actores a quienes se les permite tener acceso a los archivos, pero no a la informaci\u00f3n confidencial. Esta informaci\u00f3n tambi\u00e9n est\u00e1 disponible a trav\u00e9s de la interfaz web del producto."}], "lastModified": "2024-03-25T16:24:56.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D90E9D5-EAC5-480A-9DF5-9726B34807AC", "versionEndExcluding": "3.1"}, {"criteria": "cpe:2.3:a:siemens:sinema_remote_connect_client:3.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3100A7B5-00F4-4DB9-951F-23F548256C9B"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}