CVE-2023-46601

A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*

History

20 Nov 2023, 13:41

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~() https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf -~~	() https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf - Vendor Advisory
CPE		cpe:2.3:a:siemens:comos::::::::
First Time		Siemens Siemens comos

14 Nov 2023, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-14 11:15

Updated : 2023-12-10 15:26

NVD link : CVE-2023-46601

Mitre link : CVE-2023-46601

CVE.ORG link : CVE-2023-46601

JSON object : View

Products Affected

siemens

comos

CWE

CWE-284

Improper Access Control

{"id": "CVE-2023-46601", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}]}, "published": "2023-11-14T11:15:15.293", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en COMOS (todas las versiones). La aplicaci\u00f3n afectada carece de controles de acceso adecuados para realizar la conexi\u00f3n a SQLServer. Esto podr\u00eda permitir a un atacante consultar la base de datos directamente para acceder a informaci\u00f3n a la que el usuario no deber\u00eda tener acceso."}], "lastModified": "2023-11-20T13:41:15.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61597661-A3B0-4A14-AA6B-C911E0063390"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}