7.8

CVE-2021-27380

A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12532)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Solid Edge Version < se2020
Siemens ≫ Solid Edge Version se2020 Update -
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack1
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack10
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack11
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack12
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack2
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack3
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack4
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack5
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack6
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack7
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack8
Siemens ≫ Solid Edge Version se2020 Update maintenance_pack9
Siemens ≫ Solid Edge Version se2021 Update -
Siemens ≫ Solid Edge Version se2021 Update maintenance_pack1
Siemens ≫ Solid Edge Version se2021 Update maintenance_pack2
Siemens ≫ Solid Edge Version se2021 Update maintenance_pack3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.44% 0.697
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://cert-portal.siemens.com/productcert/pdf/ssa-574442.pdf
Patch
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf
Patch
Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-06
Third Party Advisory
US Government Resource