CVE-2022-29034 | THREATINT

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks.

Reserved 2022-04-11 | Published 2022-06-14 | Updated 2024-08-03 | Assigner siemens

MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

unknown

Any version before V3.1

affected

References

cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

seclists.org/fulldisclosure/2022/Jun/35 (20220614 SEC Consult SA-20220614-0 :: Reflected Cross Site Scripting in SIEMENS-SINEMA Remote Connect) mailing-list

packetstormsecurity.com/...1.00.02-Cross-Site-Scripting.html

cert-portal.siemens.com/productcert/html/ssa-484086.html

cve.org (CVE-2022-29034)

nvd.nist.gov (CVE-2022-29034)

Download JSON