CVE-2023-38640

A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:sicam_pas\/pqs:*:*:*:*:*:*:*:*

History

14 Oct 2023, 02:43

Type	Values Removed	Values Added
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf -~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf - Patch, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.6~~	v2 : unknown v3 : 4.4
First Time		Siemens sicam Pas\/pqs Siemens
CPE		cpe:2.3:a:siemens:sicam_pas\/pqs::::::::

10 Oct 2023, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-10 11:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-38640

Mitre link : CVE-2023-38640

CVE.ORG link : CVE-2023-38640

JSON object : View

Products Affected

siemens

sicam_pas\/pqs

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2023-38640", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.8}]}, "published": "2023-10-10T11:15:12.063", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SICAM PAS/PQS (Todas las versiones >= V8.00 < V8.22). La aplicaci\u00f3n afectada se instala con archivos y carpetas espec\u00edficos con permisos inseguros. Esto podr\u00eda permitir que un atacante local autenticado lea y modifique datos de configuraci\u00f3n en el contexto del proceso de solicitud."}], "lastModified": "2023-10-14T02:43:46.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sicam_pas\\/pqs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F7F0A64-D3B9-483E-ABB5-86479D276D07", "versionEndExcluding": "8.22", "versionStartIncluding": "8.00"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}