CVE-2013-0672

Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf	US Government Resource
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf	Vendor Advisory
http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf	US Government Resource
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:wincc_tia_portal:11.0:*:*:*:*:*:*:*

History

21 Nov 2024, 01:47

Type	Values Removed	Values Added
References	~~() http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf - US Government Resource~~	() http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf - US Government Resource
References	~~() http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf - Vendor Advisory~~	() http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf - Vendor Advisory

Information

Published : 2013-03-21 14:55

Updated : 2024-11-21 01:47

NVD link : CVE-2013-0672

Mitre link : CVE-2013-0672

CVE.ORG link : CVE-2013-0672

JSON object : View

Products Affected

siemens

wincc_tia_portal

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2013-0672", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-03-21T14:55:01.547", "references": [{"url": "http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la aplicaci\u00f3n web HMI en Siemens WinCC (TIA Portal) 11 permite a usuarios remotamente autenticados permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s datos sin especificar."}], "lastModified": "2024-11-21T01:47:59.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:wincc_tia_portal:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA0630E4-BC67-46D1-90C5-8E5F3AAC86F4"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}