Vulnerability · Published Oct 10, 2023 · Assigned by siemens

CVE-2023-35796

High 8.3

In plain English

A high-severity cross-site scripting in SINEMA Server V14 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.6%top 49.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with `SYSTEM` privileges on the application server. (ZDI-CAN-19823)

Affected products (as reported)

Vendor	Product	Versions
Siemens	SINEMA Server V14	All versions

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C

References

https://cert-portal.siemens.com/productcert/pdf/ssa-594373.pdf