cnvd - cnvd-2018-24247

CNVD-2018-24247

Vulnerability from cnvd - Published: 2018-11-29

Title

多款Siemens产品开放重定向漏洞

Description

Siemens SIMATIC HMI Comfort Panels等都是德国西门子（Siemens）公司的用于操控和监控机器和设备的HMI软件。多款Siemens产品中的webserver存在开放重定向漏洞，攻击者可借助恶意的链接利用该漏洞将用户重定向到不可信的网站。

Severity

高

Patch Name

多款Siemens产品开放重定向漏洞的补丁

Patch Description

Siemens SIMATIC HMI Comfort Panels等都是德国西门子（Siemens）公司的用于操控和监控机器和设备的HMI软件。多款Siemens产品中的webserver存在开放重定向漏洞，攻击者可借助恶意的链接利用该漏洞将用户重定向到不可信的网站。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://support.industry.siemens.com/cs/document/109755826/updates-for-step-7-v15-and-wincc-v15?dti=0&lc=en-WW

Reference

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-08

Impacted products

Name
['Siemens SIMATIC HMI Comfort Panels 4”-22” <15 Update 4', 'Siemens SIMATIC HMI Comfort Outdoor Panels 7” & 15” <15 Update 4', 'Siemens SIMATIC HMI KTP Mobile Panels（KTP400F、KTP700、KTP700F、KTP900和KTP900F） <15 Update 4', 'Siemens SIMATIC WinCC Runtime Advanced <15 Update 4', 'Siemens SIMATIC WinCC Runtime Professional <15 Update 4', 'Siemens SIMATIC WinCC (TIA Portal) <15 Update 4', 'Siemens SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)']

Name

['Siemens SIMATIC HMI Comfort Panels 4”-22” <15 Update 4', 'Siemens SIMATIC HMI Comfort Outdoor Panels 7” & 15” <15 Update 4', 'Siemens SIMATIC HMI KTP Mobile Panels（KTP400F、KTP700、KTP700F、KTP900和KTP900F） <15 Update 4', 'Siemens SIMATIC WinCC Runtime Advanced <15 Update 4', 'Siemens SIMATIC WinCC Runtime Professional <15 Update 4', 'Siemens SIMATIC WinCC (TIA Portal) <15 Update 4', 'Siemens SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-13813"
    }
  },
  "description": "Siemens SIMATIC HMI Comfort Panels\u7b49\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u7528\u4e8e\u64cd\u63a7\u548c\u76d1\u63a7\u673a\u5668\u548c\u8bbe\u5907\u7684HMI\u8f6f\u4ef6\u3002\n\n\u591a\u6b3eSiemens\u4ea7\u54c1\u4e2d\u7684webserver\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u4e0d\u53ef\u4fe1\u7684\u7f51\u7ad9\u3002",
  "discovererName": "Hosni Tounsi",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://support.industry.siemens.com/cs/document/109755826/updates-for-step-7-v15-and-wincc-v15?dti=0\u0026lc=en-WW",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24247",
  "openTime": "2018-11-29",
  "patchDescription": "Siemens SIMATIC HMI Comfort Panels\u7b49\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u7528\u4e8e\u64cd\u63a7\u548c\u76d1\u63a7\u673a\u5668\u548c\u8bbe\u5907\u7684HMI\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eSiemens\u4ea7\u54c1\u4e2d\u7684webserver\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u4e0d\u53ef\u4fe1\u7684\u7f51\u7ad9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSiemens\u4ea7\u54c1\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC HMI Comfort Panels 4\u201d-22\u201d \u003c15 Update 4",
      "Siemens SIMATIC HMI Comfort Outdoor Panels 7\u201d \u0026 15\u201d \u003c15 Update 4",
      "Siemens SIMATIC HMI KTP Mobile Panels\uff08KTP400F\u3001KTP700\u3001KTP700F\u3001KTP900\u548cKTP900F\uff09 \u003c15 Update 4",
      "Siemens SIMATIC WinCC Runtime Advanced \u003c15 Update 4",
      "Siemens SIMATIC WinCC Runtime Professional \u003c15 Update 4",
      "Siemens SIMATIC WinCC (TIA Portal) \u003c15 Update 4",
      "Siemens SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-18-317-08",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-16",
  "title": "\u591a\u6b3eSiemens\u4ea7\u54c1\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2018-13813 (GCVE-0-2018-13813)

Vulnerability from cvelistv5 – Published: 2018-12-13 16:00 – Updated: 2024-08-05 09:14

Summary

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15 Update 4), SIMATIC WinCC Runtime Advanced (All versions < V15 Update 4), SIMATIC WinCC Runtime Professional (All versions < V15 Update 4), SIMATIC WinCC (TIA Portal) (All versions < V15 Update 4), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The webserver of affected HMI devices may allow URL redirections to untrusted websites. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

Severity ?

No CVSS data available.

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

siemens

References

URL

Tags

	http://www.securityfocus.com/bid/105922	vdb-entryx_refsource_BID
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Siemens AG	SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)	Affected: SIMATIC HMI Comfort Panels 4" - 22" : All versions < V15 Update 4 Affected: SIMATIC HMI Comfort Outdoor Panels 7" & 15" : All versions < V15 Update 4 Affected: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions < V15 Update 4 Affected: SIMATIC WinCC Runtime Advanced : All versions < V15 Update 4 Affected: SIMATIC WinCC Runtime Professional : All versions < V15 Update 4 Affected: SIMATIC WinCC (TIA Portal) : All versions < V15 Update 4 Affected: SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:14:47.263Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105922",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105922"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions \u003c V15 Update 4"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" : All versions \u003c V15 Update 4"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions \u003c V15 Update 4"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC Runtime Advanced : All versions \u003c V15 Update 4"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC Runtime Professional : All versions \u003c V15 Update 4"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC (TIA Portal) : All versions \u003c V15 Update 4"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
            }
          ]
        }
      ],
      "datePublic": "2018-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\" - 22\" (All versions \u003c V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" (All versions \u003c V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions \u003c V15 Update 4), SIMATIC WinCC Runtime Advanced (All versions \u003c V15 Update 4), SIMATIC WinCC Runtime Professional (All versions \u003c V15 Update 4), SIMATIC WinCC (TIA Portal) (All versions \u003c V15 Update 4), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The webserver of affected HMI devices may allow URL redirections to untrusted websites. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-14T10:57:02",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "name": "105922",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105922"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2018-13813",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions \u003c V15 Update 4"
                          },
                          {
                            "version_value": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" : All versions \u003c V15 Update 4"
                          },
                          {
                            "version_value": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions \u003c V15 Update 4"
                          },
                          {
                            "version_value": "SIMATIC WinCC Runtime Advanced : All versions \u003c V15 Update 4"
                          },
                          {
                            "version_value": "SIMATIC WinCC Runtime Professional : All versions \u003c V15 Update 4"
                          },
                          {
                            "version_value": "SIMATIC WinCC (TIA Portal) : All versions \u003c V15 Update 4"
                          },
                          {
                            "version_value": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens AG"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\" - 22\" (All versions \u003c V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" (All versions \u003c V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions \u003c V15 Update 4), SIMATIC WinCC Runtime Advanced (All versions \u003c V15 Update 4), SIMATIC WinCC Runtime Professional (All versions \u003c V15 Update 4), SIMATIC WinCC (TIA Portal) (All versions \u003c V15 Update 4), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The webserver of affected HMI devices may allow URL redirections to untrusted websites. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105922",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105922"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2018-13813",
    "datePublished": "2018-12-13T16:00:00",
    "dateReserved": "2018-07-10T00:00:00",
    "dateUpdated": "2024-08-05T09:14:47.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-24247

CVE-2018-13813 (GCVE-0-2018-13813)

Tags

Sightings

Nomenclature