CVE-2019-13947

MEDIUM4.9

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1

Published Dec 12, 2019

Modified 1 years ago

Details

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The user configuration menu in the web interface of the Control Center Server (CCS) transfers user passwords in clear to the client (browser).

An attacker with administrative privileges for the web interface could be able to read (and not only reset) passwords of other CCS users.

References

WEB

https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf

WEB

https://cert-portal.siemens.com/productcert/pdf/ssa-761844.pdf

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2019-13947

CVSS Analysis

CVSS v3.1

4.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

4.9/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Other

CWE-317

Ecosystems

Timeline

PublishedDec 12, 2019

ModifiedAug 5, 2024