File Upload Vulnerability in SPPA-T3000 Application Server by Siemens
CVE-2019-18320

7.5HIGH

Key Information:

Vendor
Siemens
Status
Sppa-t3000 Application Server
Vendor
CVE Published:
12 December 2019

Summary

A vulnerability has been discovered in the SPPA-T3000 Application Server that enables an attacker with network access to upload arbitrary files without authentication. This flaw applies to all versions below Service Pack R8.2 SP2. Exploitation requires network access to the Application Server, but as of the advisory's release, no instances of public exploitation have been reported.

Affected Version(s)

SPPA-T3000 Application Server All versions < Service Pack R8.2 SP2

References

https://cert-portal.siemens.com/productcert/pdf/ssa-45144...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.