Authorization Bypass Vulnerability in SmartClient Modules by Siemens

CVE-2024-41979

What is CVE-2024-41979?

A flaw exists in certain SmartClient modules by Siemens, where the application fails to enforce necessary authorization on specific server-side functionalities. This oversight enables an authenticated attacker to potentially attain full access to the application. Affected modules include various versions of Opcenter QL Home, SOA Audit, and SOA Cockpit, specifically those from version 13.2 up to but not including version 2506. Proper assessment and remediation are essential to mitigate potential exploitation.

References