CVE-2022-44731mediumCWE-88

CVE-2022-44731: fallo de gravedad media en Siemens SIMATIC WinCC OA V3.15

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SIMATIC WinCC OA

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.6%
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Productos afectados
Siemens · SIMATIC WinCC OA V3.15Siemens · SIMATIC WinCC OA V3.16Siemens · SIMATIC WinCC OA V3.17Siemens · SIMATIC WinCC OA V3.18
CVEs relacionadas — Siemens SIMATIC WinCC OA V3.15

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-33139—CVE-2022-33139EPSS 1.3%CVE-2023-28831HIGHCVE-2023-28831EPSS 1.1%CVE-2020-7580—CVE-2020-7580EPSS 0.5%CVE-2023-46280HIGHCVE-2023-46280EPSS 0.3%