CVE-2021-37197: Siemens COMOS V10.2, инжекция

Описание

Оригинално описание

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.

Засегнати продукти

• Siemens COMOS V10.2: All versions only if web components are used
• Siemens COMOS V10.3: All versions < V10.3.3.3 only if web components are used
• Siemens COMOS V10.4: All versions < V10.4.1 only if web components are used

Вид слабост

• CWE-89 SQL инжекция

История

Други уязвимости в Siemens COMOS V10.2

• 5.9CVE-2024-54005
• 5.7CVE-2024-49704
• 10.0CVE-2023-24482
• CVE-2021-37194
• 8.8CVE-2021-37198

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-37197
• https://nvd.nist.gov/vuln/detail/CVE-2021-37197
• https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf