Siemens SINEC NMS
En bref
- Source
- NVD
- EPSS
- EPSS 20.62 % · centile 98 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- siemens
- Statut NVD
- Modified
Rechercher sur…
Description
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-17927
- GCVE · GCVE-0-2020-25237
Avis du CERT-FR
- CERTFR-2021-AVI-094 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*< 1.0cpe:2.3:a:siemens:sinec_network_management_system:1.0:-:*:*:*:*:*:*cpe:2.3:a:siemens:sinec_network_management_system:1.0:sp1:*:*:*:*:*:*cpe:2.3:a:siemens:sinema_server:*:*:*:*:*:*:*:*< 14.0cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:*cpe:2.3:a:siemens:sinema_server:14.0:sp1:*:*:*:*:*:*cpe:2.3:a:siemens:sinema_server:14.0:sp2:*:*:*:*:*:*cpe:2.3:a:siemens:sinema_server:14.0:sp2_update1:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Siemens · SINEC NMS | affected All versions < V1.0 SP1 Update 1 |
| Siemens · SINEMA Server | affected All versions < V14.0 SP2 Update 2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |