var-202111-0482
Vulnerability from variot
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system. SIMATIC PCS 7 and SIMATIC WinCC Contains a vulnerability related to information leakage from log files.Information may be obtained
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-202111-0482", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "simatic pcs 7", scope: "gte", trust: 1, vendor: "siemens", version: "9.0", }, { model: "simatic wincc", scope: "eq", trust: 1, vendor: "siemens", version: "15", }, { model: "simatic wincc", scope: "eq", trust: 1, vendor: "siemens", version: "17", }, { model: "simatic pcs 7", scope: "lt", trust: 1, vendor: "siemens", version: "9.1", }, { model: "simatic wincc", scope: "eq", trust: 1, vendor: "siemens", version: "16", }, { model: "simatic wincc", scope: "eq", trust: 1, vendor: "siemens", version: "7.5", }, { model: "simatic wincc", scope: "lte", trust: 1, vendor: "siemens", version: "7.4", }, { model: "simatic pcs 7", scope: "eq", trust: 1, vendor: "siemens", version: "9.1", }, { model: "simatic pcs 7", scope: "lte", trust: 1, vendor: "siemens", version: "8.2", }, { model: "simatic wincc", scope: null, trust: 0.8, vendor: "シーメンス", version: null, }, { model: "simatic pcs 7", scope: null, trust: 0.8, vendor: "シーメンス", version: null, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "NVD", id: "CVE-2021-40364", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "7.4", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "8.2", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp1_update2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:-:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:16:-:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:7.5:sp2_update4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:17:update1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:17:-:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:16:update1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:16:update2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:16:update3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_wincc:16:update4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_pcs_7:9.1:-:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_pcs_7:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "9.1", versionStartIncluding: "9.0", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2021-40364", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Thomas Riedmaier from Siemens Energy reported these vulnerabilities to Siemens.", sources: [ { db: "CNNVD", id: "CNNVD-202111-780", }, ], trust: 0.6, }, cve: "CVE-2021-40364", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", author: "NVD", availabilityImpact: "NONE", baseScore: 2.1, confidentialityImpact: "PARTIAL", exploitabilityScore: 3.9, impactScore: 2.9, integrityImpact: "NONE", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "LOW", trust: 1, userInteractionRequired: false, vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Local", authentication: "None", author: "NVD", availabilityImpact: "None", baseScore: 2.1, confidentialityImpact: "Partial", exploitabilityScore: null, id: "CVE-2021-40364", impactScore: null, integrityImpact: "None", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "Low", trust: 0.8, userInteractionRequired: null, vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", author: "VULHUB", availabilityImpact: "NONE", baseScore: 2.1, confidentialityImpact: "PARTIAL", exploitabilityScore: 3.9, id: "VHN-401721", impactScore: 2.9, integrityImpact: "NONE", severity: "LOW", trust: 0.1, vectorString: "AV:L/AC:L/AU:N/C:P/I:N/A:N", version: "2.0", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "LOCAL", author: "NVD", availabilityImpact: "NONE", baseScore: 5.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", exploitabilityScore: 1.8, impactScore: 3.6, integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", trust: 2, userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, { attackComplexity: "Low", attackVector: "Local", author: "NVD", availabilityImpact: "None", baseScore: 5.5, baseSeverity: "Medium", confidentialityImpact: "High", exploitabilityScore: null, id: "CVE-2021-40364", impactScore: null, integrityImpact: "None", privilegesRequired: "Low", scope: "Unchanged", trust: 0.8, userInteraction: "None", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, ], severity: [ { author: "NVD", id: "CVE-2021-40364", trust: 1.8, value: "MEDIUM", }, { author: "productcert@siemens.com", id: "CVE-2021-40364", trust: 1, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-202111-780", trust: 0.6, value: "MEDIUM", }, { author: "VULHUB", id: "VHN-401721", trust: 0.1, value: "LOW", }, ], }, ], sources: [ { db: "VULHUB", id: "VHN-401721", }, { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "NVD", id: "CVE-2021-40364", }, { db: "NVD", id: "CVE-2021-40364", }, { db: "CNNVD", id: "CNNVD-202111-780", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system. SIMATIC PCS 7 and SIMATIC WinCC Contains a vulnerability related to information leakage from log files.Information may be obtained", sources: [ { db: "NVD", id: "CVE-2021-40364", }, { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "VULHUB", id: "VHN-401721", }, ], trust: 1.71, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2021-40364", trust: 3.3, }, { db: "SIEMENS", id: "SSA-840188", trust: 1.7, }, { db: "JVNDB", id: "JVNDB-2021-014828", trust: 0.8, }, { db: "AUSCERT", id: "ESB-2021.3874", trust: 0.6, }, { db: "ICS CERT", id: "ICSA-21-315-03", trust: 0.6, }, { db: "CNNVD", id: "CNNVD-202111-780", trust: 0.6, }, { db: "VULHUB", id: "VHN-401721", trust: 0.1, }, ], sources: [ { db: "VULHUB", id: "VHN-401721", }, { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "NVD", id: "CVE-2021-40364", }, { db: "CNNVD", id: "CNNVD-202111-780", }, ], }, id: "VAR-202111-0482", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VULHUB", id: "VHN-401721", }, ], trust: 0.709197615, }, last_update_date: "2023-12-18T11:36:40.176000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "SSA-840188", trust: 0.8, url: "https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf", }, { title: "Siemens SIMATIC PCS 7 and SIMATIC WinCC Repair measures for log information disclosure vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=169661", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "CNNVD", id: "CNNVD-202111-780", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-532", trust: 1.1, }, { problemtype: "Information leakage from log files (CWE-532) [NVD evaluation ]", trust: 0.8, }, ], sources: [ { db: "VULHUB", id: "VHN-401721", }, { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "NVD", id: "CVE-2021-40364", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 1.7, url: "https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2021-40364", }, { trust: 0.6, url: "https://vigilance.fr/vulnerability/simatic-multiple-vulnerabilities-via-wincc-36835", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2021.3874", }, { trust: 0.6, url: "https://us-cert.cisa.gov/ics/advisories/icsa-21-315-03", }, ], sources: [ { db: "VULHUB", id: "VHN-401721", }, { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "NVD", id: "CVE-2021-40364", }, { db: "CNNVD", id: "CNNVD-202111-780", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULHUB", id: "VHN-401721", }, { db: "JVNDB", id: "JVNDB-2021-014828", }, { db: "NVD", id: "CVE-2021-40364", }, { db: "CNNVD", id: "CNNVD-202111-780", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2021-11-09T00:00:00", db: "VULHUB", id: "VHN-401721", }, { date: "2022-10-28T00:00:00", db: "JVNDB", id: "JVNDB-2021-014828", }, { date: "2021-11-09T12:15:10.070000", db: "NVD", id: "CVE-2021-40364", }, { date: "2021-11-09T00:00:00", db: "CNNVD", id: "CNNVD-202111-780", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2022-07-28T00:00:00", db: "VULHUB", id: "VHN-401721", }, { date: "2022-10-28T06:51:00", db: "JVNDB", id: "JVNDB-2021-014828", }, { date: "2023-04-11T10:15:10.807000", db: "NVD", id: "CVE-2021-40364", }, { date: "2022-08-10T00:00:00", db: "CNNVD", id: "CNNVD-202111-780", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "local", sources: [ { db: "CNNVD", id: "CNNVD-202111-780", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "SIMATIC PCS 7 and SIMATIC WinCC Vulnerability regarding information leakage from log files in", sources: [ { db: "JVNDB", id: "JVNDB-2021-014828", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "log information leak", sources: [ { db: "CNNVD", id: "CNNVD-202111-780", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.