var-202008-0307
Vulnerability from variot
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application. SICAM A8000 RTUs for SICAM WEB A cross-site scripting vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. The SICAM A8000 RTU (Remote Terminal Equipment) series is a modular equipment series suitable for remote control and automation applications in all energy supply fields. The vulnerability is due to the failure of the login screen to adequately filter the input
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202008-0307", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "sicam a8000", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "05.30" }, { "model": "sicam a8000", "scope": "eq", "trust": 0.8, "vendor": "siemens", "version": "05.30" }, { "model": "sicam web for sicam a8000 rtus", "scope": "lt", "trust": 0.6, "vendor": "siemens", "version": "v05.30" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "NVD", "id": "CVE-2020-15781" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:siemens:sicam_a8000_firmware", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2020-009610" } ] }, "cve": "CVE-2020-15781", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CVE-2020-15781", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 1.0, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 6.8, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "JVNDB-2020-009610", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 4.9, "id": "CNVD-2020-45701", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "id": "CVE-2020-15781", "impactScore": 6.0, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 9.6, "baseSeverity": "Critical", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "JVNDB-2020-009610", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Changed", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2020-15781", "trust": 1.0, "value": "CRITICAL" }, { "author": "NVD", "id": "JVNDB-2020-009610", "trust": 0.8, "value": "Critical" }, { "author": "CNVD", "id": "CNVD-2020-45701", "trust": 0.6, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202008-578", "trust": 0.6, "value": "CRITICAL" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "CNNVD", "id": "CNNVD-202008-578" }, { "db": "NVD", "id": "CVE-2020-15781" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions \u003c V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application. SICAM A8000 RTUs for SICAM WEB A cross-site scripting vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. The SICAM A8000 RTU (Remote Terminal Equipment) series is a modular equipment series suitable for remote control and automation applications in all energy supply fields. The vulnerability is due to the failure of the login screen to adequately filter the input", "sources": [ { "db": "NVD", "id": "CVE-2020-15781" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "CNVD", "id": "CNVD-2020-45701" } ], "trust": 2.16 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2020-15781", "trust": 3.0 }, { "db": "SIEMENS", "id": "SSA-370042", "trust": 2.2 }, { "db": "ICS CERT", "id": "ICSA-20-224-08", "trust": 1.4 }, { "db": "JVN", "id": "JVNVU96514651", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2020-009610", "trust": 0.8 }, { "db": "CNVD", "id": "CNVD-2020-45701", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.2777", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202008-578", "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "CNNVD", "id": "CNNVD-202008-578" }, { "db": "NVD", "id": "CVE-2020-15781" } ] }, "id": "VAR-202008-0307", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" } ], "trust": 1.400595225 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS", "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" } ] }, "last_update_date": "2024-11-23T20:09:39.819000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "SSA-370042", "trust": 0.8, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-370042.pdf" }, { "title": "Patch for Siemens SICAM A8000 RTU cross-site scripting vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/230224" }, { "title": "Siemens SICAM A8000 RTUs Fixes for cross-site scripting vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=126220" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "CNNVD", "id": "CNNVD-202008-578" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-79", "trust": 1.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "NVD", "id": "CVE-2020-15781" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.2, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-370042.pdf" }, { "trust": 1.4, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-224-08" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15781" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-15781" }, { "trust": 0.8, "url": "https://jvn.jp/vu/jvnvu96514651/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.2777/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-45701" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "CNNVD", "id": "CNNVD-202008-578" }, { "db": "NVD", "id": "CVE-2020-15781" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2020-45701" }, { "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "db": "CNNVD", "id": "CNNVD-202008-578" }, { "db": "NVD", "id": "CVE-2020-15781" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-08-12T00:00:00", "db": "CNVD", "id": "CNVD-2020-45701" }, { "date": "2020-11-20T07:22:38", "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "date": "2020-08-11T00:00:00", "db": "CNNVD", "id": "CNNVD-202008-578" }, { "date": "2020-08-14T16:15:16.853000", "db": "NVD", "id": "CVE-2020-15781" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-08-12T00:00:00", "db": "CNVD", "id": "CNVD-2020-45701" }, { "date": "2020-11-20T07:22:38", "db": "JVNDB", "id": "JVNDB-2020-009610" }, { "date": "2021-01-05T00:00:00", "db": "CNNVD", "id": "CNNVD-202008-578" }, { "date": "2024-11-21T05:06:10.020000", "db": "NVD", "id": "CVE-2020-15781" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202008-578" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "SICAM A8000 RTUs for SICAM WEB Cross-site scripting vulnerability in firmware", "sources": [ { "db": "JVNDB", "id": "JVNDB-2020-009610" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "XSS", "sources": [ { "db": "CNNVD", "id": "CNNVD-202008-578" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.