A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code on the underlying OS.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-915275.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Nov 2024, 23:12
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Siemens sinec Ins
Siemens |
|
| CPE | cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* |
|
| References | () https://cert-portal.siemens.com/productcert/html/ssa-915275.html - Vendor Advisory |
12 Nov 2024, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-12 13:15
Updated : 2024-11-13 23:12
NVD link : CVE-2024-46890
Mitre link : CVE-2024-46890
JSON object : View
Products Affected
siemens
- sinec_ins
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')