A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Apr 2022, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files. |
14 Feb 2022, 15:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:siemens:comos:10.2:*:*:*:*:*:*:* cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* |
|
| First Time |
Siemens comos
Siemens |
|
| CWE | CWE-434 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf - Patch, Vendor Advisory |
09 Feb 2022, 16:26
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-09 16:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-37194
Mitre link : CVE-2021-37194
CVE.ORG link : CVE-2021-37194
JSON object : View
Products Affected
siemens
- comos
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type