5.3
CVE-2019-10941
- EPSS 0.18%
- Published 14.09.2021 11:15:07
- Last modified 21.11.2024 04:20:12
- Source productcert@siemens.com
- Teams watchlist Login
- Open Login
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user identity could allow an attacker to obtain encoded system configuration backup files. This is only possible through network access to the affected system, and successful exploitation requires no system privileges.
Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Sinema Server Version < 14.0
Siemens ≫ Sinema Server Version14.0 Update-
Siemens ≫ Sinema Server Version14.0 Updatesp1
Siemens ≫ Sinema Server Version14.0 Updatesp2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.18% | 0.37 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.