cve-2021-37197
Vulnerability from cvelistv5
Published
2022-01-11 11:27
Modified
2024-08-04 01:16
Severity
Summary
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.
References
Source | URL | Tags |
---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf | Patch, Vendor Advisory |
Impacted products
Vendor | Product |
---|---|
Siemens | COMOS V10.2 |
Siemens | COMOS V10.3 |
Siemens | COMOS V10.4 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T01:16:02.881Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "COMOS V10.2", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions only if web components are used" } ] }, { "product": "COMOS V10.3", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V10.3.3.3 only if web components are used" } ] }, { "product": "COMOS V10.4", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V10.4.1 only if web components are used" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions \u003c V10.3.3.3 only if web components are used), COMOS V10.4 (All versions \u003c V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-04-12T09:07:15", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-37197", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "COMOS V10.2", "version": { "version_data": [ { "version_value": "All versions only if web components are used" } ] } }, { "product_name": "COMOS V10.3", "version": { "version_data": [ { "version_value": "All versions \u003c V10.3.3.3 only if web components are used" } ] } }, { "product_name": "COMOS V10.4", "version": { "version_data": [ { "version_value": "All versions \u003c V10.4.1 only if web components are used" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions \u003c V10.3.3.3 only if web components are used), COMOS V10.4 (All versions \u003c V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2021-37197", "datePublished": "2022-01-11T11:27:14", "dateReserved": "2021-07-21T00:00:00", "dateUpdated": "2024-08-04T01:16:02.881Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-37197\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2022-01-11T12:15:09.930\",\"lastModified\":\"2022-04-30T02:26:16.707\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions \u003c V10.3.3.3 only if web components are used), COMOS V10.4 (All versions \u003c V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en COMOS V10.2 (Todas las versiones s\u00f3lo si se utilizan componentes web), COMOS V10.3 (Todas las versiones anteriores a V10.3.3.3 s\u00f3lo si se utilizan componentes web), COMOS V10.4 (Todas las versiones anteriores a V10.4.1 s\u00f3lo si se utilizan componentes web). El componente COMOS Web de COMOS es vulnerable a inyecciones SQL. Esto podr\u00eda permitir a un atacante ejecutar sentencias SQL arbitrarias.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.8,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]},{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"10.2\",\"matchCriteriaId\":\"28970CC4-B11E-4B5A-88D2-CA6528CAB36A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.3\",\"versionEndExcluding\":\"10.3.3.3\",\"matchCriteriaId\":\"F4E2BA1A-7CCB-4785-82A3-27E21B83B0AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:comos:10.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDF6D202-6CF1-4B97-8386-AC05DBA41C5F\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}" } }
Loading...