Directory Traversal Flaw in Control Center Server by Siemens

CVE-2019-18338

Summary

A directory traversal vulnerability exists in Siemens' Control Center Server (CCS) in all versions prior to V1.5.0. This flaw can be exploited by authenticated remote attackers with network access to the CCS server. By leveraging this weakness in the XML-based communication protocol, attackers may gain the ability to list arbitrary directories or access files outside the intended application context, potentially leading to unauthorized information disclosure.

References