HIGH🇵🇱 Wersja polska

CVE-2022-25311

CVSS 7.3v3.1pub. 2022-03-08upd. 2024-11-21

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

  • Siemens Sinec Network Management System

    APP
    Siemens
    < 1.0.3

  • Siemens Sinema Server

    APP
    Siemens
    14.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2022-22965CRITICAL9.8⚠ KEVPL ✓same product

Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+

CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same product

SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego

CVE-2021-39275CRITICAL9.8PL ✓same product

Apache HTTP Server — buffer overflow w funkcji ap_escape_quotes()

CVE-2019-10940CRITICAL9.9PL ✓same product

Siemens SINEMA Server — błędna walidacja sesji umożliwia privilege escalation

CVE-2023-35796HIGH8.3same product

A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly s...