CVE-2023-46590

Published: Nov 14, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: productcert@siemens.com (Secondary)

Description

A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfere with an application's processing of XML data and read arbitrary files in the system.

Affected (1)

Products: Siemens: Siemens Opc Ua Modeling Editor

1 product

Siemens Opc Ua Modeling Editor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Siemens Opc Ua Modeling Editor	Before 2.8

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf

Source: productcert@siemens.com

PatchVendor Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-197270.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.