Cross-Site Request Forgery Vulnerability in COMOS by Siemens
CVE-2021-37198

8.8HIGH

Key Information:

Vendor

Siemens
Status
Comos V10.2
Comos V10.3
Comos V10.4
Vendor
CVE Published:
11 January 2022

What is CVE-2021-37198?

A vulnerability exists in the COMOS web components, impacting various versions of COMOS V10.2, V10.3, and V10.4 when web components are employed. This vulnerability arises from an inadequate implementation of CSRF prevention measures, enabling attackers to execute unauthorized commands on behalf of authenticated users. As a result, there is a potential risk for sensitive data exposure and unauthorized actions within the system.

Affected Version(s)

COMOS V10.2 All versions only if web components are used

COMOS V10.3 All versions < V10.3.3.3 only if web components are used

COMOS V10.4 All versions < V10.4.1 only if web components are used

References

https://cert-portal.siemens.com/productcert/pdf/ssa-99533...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.