CVE-2022-29034: medium-severity vulnerability in Siemens SINEMA Remote Connect Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The SINEMA Remote Connect Server web interface has a flaw where error messages don't block JavaScript code, allowing attackers to inject malicious scripts that execute in users' browsers when they click a specially crafted link.
A reflected XSS vulnerability exists in the error message pop-up window of the web interface where user input is not properly sanitized or encoded. An unauthenticated attacker can craft a malicious URL containing JavaScript payload that executes in the victim's browser context when accessed, potentially leading to session hijacking or credential theft.
In the same product, most dangerous first.