CVE Feed

    Dashboard / CVE / CVE-2023-35796

    CVE-2023-35796

    A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with `SYSTEM` privileges on the application server. (ZDI-CAN-19823)

    Published:Oct 10, 2023
    Last Modified:Nov 21, 2024
    EPS:Oct 10, 2023
    EPSS Score:0.00229
    CVSS Score:8.3

    Affected Products

    Vendor
    Siemens
    Product
    Sinema Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-25311 (CVSS 7.3) — A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1…
    CVE-2021-40438 (CVSS 9) — A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remot…
    CVE-2021-39275 (CVSS 9.8) — ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass u…
    CVE-2021-34798 (CVSS 7.5) — Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2…
    CVE-2019-10941 (CVSS 5.3) — A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for func…
    CVE-2021-3449 (CVSS 5.9) — An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.…
    CVE-2020-25237 (CVSS 8.1) — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versio…
    CVE-2020-7580 (CVSS 6.7) — A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Softwar…
    CVE-2019-10940 (CVSS 9.9) — A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session va…
    CVE-2019-6575 (CVSS 7.5) — A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controlle…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High