Cross-Origin Resource Sharing Flaw in SICAM GridEdge Essential by Siemens
CVE-2022-30228

6.5MEDIUM

Key Information:

Vendor
Siemens
Status
Sicam Gridedge Essential Arm
Sicam Gridedge Essential Intel
Sicam Gridedge Essential With Gds Arm
Sicam Gridedge Essential With Gds Intel
Vendor
CVE Published:
14 June 2022

Summary

A significant vulnerability has been identified in various versions of SICAM GridEdge Essential software, including both ARM and Intel builds as well as configurations with GDS. The flaw arises from the failure to enforce cross-origin resource sharing (CORS) restrictions during critical operations. This oversight allows attackers to potentially exploit the system if they can trick a legitimate user into accessing malicious resources. Such an attack could lead to improper handling of sensitive data and unauthorized actions within the affected systems.

Affected Version(s)

SICAM GridEdge Essential ARM All versions < V2.6.6

SICAM GridEdge Essential Intel All versions < V2.6.6

SICAM GridEdge Essential with GDS ARM All versions < V2.6.6

References

https://cert-portal.siemens.com/productcert/pdf/ssa-63133...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.