VAR-202301-0630
Vulnerability from variot - Updated: 2024-04-18 10:39A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user. The Automation License Manager (ALM) centrally manages license keys for various Siemens software products. Software products that require a license key automatically report this requirement to ALM. When ALM finds a valid license key for this software, it can be used in accordance with the End User License Agreement
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202301-0630",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.3.4.4"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "6.0.8"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.2"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "6.0.9"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.0.0"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "6.0"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "6.0.1"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.1"
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "5.3"
},
{
"model": "automation license manager",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
},
{
"model": "automation license manager",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "5"
},
{
"model": "automation license manager sp9 upd4",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "6\u003c6.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.1:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:6.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:6.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:6.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.3.4.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:automation_license_manager:5.3:sp3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"cve": "CVE-2022-43513",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 8.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2023-02705",
"impactScore": 7.8,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "productcert@siemens.com",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2022-43513",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2022-43513",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "productcert@siemens.com",
"id": "CVE-2022-43513",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2023-02705",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202301-659",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions \u003c V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions \u003c V3.1.2). The affected components allow to rename license files with user chosen input without authentication. \r\nThis could allow an unauthenticated remote attacker to rename and move files as SYSTEM user. The Automation License Manager (ALM) centrally manages license keys for various Siemens software products. Software products that require a license key automatically report this requirement to ALM. When ALM finds a valid license key for this software, it can be used in accordance with the End User License Agreement",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-43513"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "VULHUB",
"id": "VHN-440567"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-43513",
"trust": 3.9
},
{
"db": "SIEMENS",
"id": "SSA-476715",
"trust": 2.3
},
{
"db": "SIEMENS",
"id": "SSA-556635",
"trust": 1.0
},
{
"db": "ICS CERT",
"id": "ICSA-23-012-10",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU90782730",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2023-02705",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202301-659",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-440567",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "VULHUB",
"id": "VHN-440567"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"id": "VAR-202301-0630",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "VULHUB",
"id": "VHN-440567"
}
],
"trust": 1.4756892
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
}
]
},
"last_update_date": "2024-04-18T10:39:52.317000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-476715",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf"
},
{
"title": "Patch for External Control Vulnerability of Siemens Automation License Manager File Name or Path",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/397246"
},
{
"title": "Siemens Automation License Manager Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=221645"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-610",
"trust": 1.1
},
{
"problemtype": "Externally controllable reference to another region resource (CWE-610) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": "CWE-73",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-440567"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf"
},
{
"trust": 1.6,
"url": "https://cert-portal.siemens.com/productcert/html/ssa-476715.html"
},
{
"trust": 1.0,
"url": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu90782730/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-43513"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-012-10"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-43513/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "VULHUB",
"id": "VHN-440567"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"db": "VULHUB",
"id": "VHN-440567"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
},
{
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-01-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"date": "2023-01-10T00:00:00",
"db": "VULHUB",
"id": "VHN-440567"
},
{
"date": "2023-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"date": "2023-01-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202301-659"
},
{
"date": "2023-01-10T12:15:23.207000",
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-01-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2023-02705"
},
{
"date": "2023-01-13T00:00:00",
"db": "VULHUB",
"id": "VHN-440567"
},
{
"date": "2023-05-16T04:47:00",
"db": "JVNDB",
"id": "JVNDB-2023-001810"
},
{
"date": "2023-01-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202301-659"
},
{
"date": "2024-04-09T09:15:19.323000",
"db": "NVD",
"id": "CVE-2022-43513"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Automation\u00a0License\u00a0Manager\u00a0 Vulnerability in externally controllable references to resources in another region of",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-001810"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202301-659"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…