CVE-2012-3009

Siemens COMOS before 9.1 Patch 413, 9.2 before Update 03 Patch 023, and 10.0 before Patch 005 allows remote authenticated users to obtain database administrative access via unspecified method calls.

CVSS v2.0 8.5 HIGH

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-312568.pdf	Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf	US Government Resource
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-312568.pdf	Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf	US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:comos::::::::
	cpe:2.3:a:siemens:comos:9.2:03::::::
	cpe:2.3:a:siemens:comos:10.0:::::::*

History

21 Nov 2024, 01:40

Type	Values Removed	Values Added
References	~~() http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-312568.pdf - Vendor Advisory~~	() http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-312568.pdf - Vendor Advisory
References	~~() http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf - US Government Resource~~	() http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf - US Government Resource

Information

Published : 2012-08-16 10:38

Updated : 2024-11-21 01:40

NVD link : CVE-2012-3009

Mitre link : CVE-2012-3009

CVE.ORG link : CVE-2012-3009

JSON object : View

Products Affected

siemens

comos

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-3009", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-08-16T10:38:04.407", "references": [{"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-312568.pdf", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-312568.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Siemens COMOS before 9.1 Patch 413, 9.2 before Update 03 Patch 023, and 10.0 before Patch 005 allows remote authenticated users to obtain database administrative access via unspecified method calls."}, {"lang": "es", "value": "Siemens COMOS antes de v9.1 Patch 413, v9.2 antes de Update 03 Patch 023 y v10.0 antes de Patch 005 permite a usuarios remotos autenticados obtener acceso a la base de datos administrativa a trav\u00e9s de llamadas a m\u00e9todos no especificados.\r\n"}], "lastModified": "2024-11-21T01:40:06.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C02B178-BDB6-4AED-A1D1-E730D41FA6C5", "versionEndIncluding": "9.1"}, {"criteria": "cpe:2.3:a:siemens:comos:9.2:03:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A12943EF-26C9-477C-B586-5235E6CEB3BB"}, {"criteria": "cpe:2.3:a:siemens:comos:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACCFB2A5-EFEC-4AD0-9A9F-67106F1FFF09"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}