8.8

CVE-2024-45386

A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSiemens
≫
Produkt SIMATIC PCS neo V4.0
Default Statusunknown
Version < *
Version 0
Status affected
HerstellerSiemens
≫
Produkt SIMATIC PCS neo V4.1
Default Statusunknown
Version < V4.1 Update 2
Version 0
Status affected
HerstellerSiemens
≫
Produkt SIMATIC PCS neo V5.0
Default Statusunknown
Version < V5.0 Update 1
Version 0
Status affected
HerstellerSiemens
≫
Produkt SIMOCODE ES V19
Default Statusunknown
Version < V19 Update 1
Version 0
Status affected
HerstellerSiemens
≫
Produkt SIRIUS Safety ES V19 (TIA Portal)
Default Statusunknown
Version < V19 Update 1
Version 0
Status affected
HerstellerSiemens
≫
Produkt SIRIUS Soft Starter ES V19 (TIA Portal)
Default Statusunknown
Version < V19 Update 1
Version 0
Status affected
HerstellerSiemens
≫
Produkt TIA Administrator
Default Statusunknown
Version < V3.0.4
Version 0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.334
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
productcert@siemens.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
productcert@siemens.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."