XML Parsing Vulnerability in Siemens Solid Edge Applications
CVE-2020-28387

5.5MEDIUM

Key Information:

Vendor
Siemens
Status
Solid Edge Se2020
Solid Edge Se2021
Vendor
CVE Published:
15 March 2021

Summary

A vulnerability exists in Siemens Solid Edge applications that allows remote attackers to access arbitrary files when a specially crafted SEECTCXML file is opened. This issue arises due to insufficient restrictions on the XML parser, enabling attackers to exploit the application without appropriate prohibitions on external DTDs. This can potentially lead to unauthorized information disclosure, compromising the integrity of sensitive data.

Affected Version(s)

Solid Edge SE2020 All Versions < SE2020MP13

Solid Edge SE2021 All Versions < SE2021MP3

References

https://cert-portal.siemens.com/productcert/pdf/ssa-71518...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.