Vulnerability · Published Aug 2, 2024 · Assigned by siemens

CVE-2024-38878

High 7.2

In plain English

A high-severity path traversal in Omnivise T3000 Application Server R9.2 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.5% (higher than 96% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)11.5%top 4.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download arbitrary files from the file system.

Affected products (as reported)

Vendor	Product	Versions
Siemens	Omnivise T3000 Application Server R9.2	0 – before *
Siemens	Omnivise T3000 R8.2 SP3	0 – before *
Siemens	Omnivise T3000 R8.2 SP4	0 – before *

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

In plain English

Official description

Affected products (as reported)

References