Multiple vulnerabilities in Siemens User Management Component (UMC)



Risk Medium
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2023-46281
CVE-2023-46282
CVE-2023-46283
CVE-2023-46284
CVE-2023-46285
CWE-ID CWE-942
CWE-79
CWE-119
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Opcenter Quality
Server applications / SCADA systems

SINUMERIK Integrate RunMyHMI /Automotive
Server applications / SCADA systems

Totally Integrated Automation Portal (TIA Portal)
Other software / Other software solutions

User Management Component (UMC)
Other software / Other software solutions

SIMATIC PCS neo
Web applications / Other software

Vendor Siemens

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Overly permissive cross-domain whitelist

EUVDB-ID: #VU84369

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46281

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass the CORS protection mechanism.

The vulnerability exists due to incorrect processing of the "Origin" HTTP header that is supplied within HTTP request. A remote attacker can supply arbitrary value via the "Origin" HTTP header, bypass implemented CORS protection mechanism and perform cross-site scripting attacks against the vulnerable application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Opcenter Quality: All versions

SINUMERIK Integrate RunMyHMI /Automotive: All versions

Totally Integrated Automation Portal (TIA Portal): 14 - 18

SIMATIC PCS neo: before 4.1

User Management Component (UMC): before 2.11.2

CPE2.3 External links

http://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU84371

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46282

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web interface. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Opcenter Quality: All versions

SINUMERIK Integrate RunMyHMI /Automotive: All versions

Totally Integrated Automation Portal (TIA Portal): 14 - 18

SIMATIC PCS neo: before 4.1

User Management Component (UMC): before 2.11.2

CPE2.3 External links

http://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU84375

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46283

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Opcenter Quality: All versions

SINUMERIK Integrate RunMyHMI /Automotive: All versions

Totally Integrated Automation Portal (TIA Portal): 14 - 18

SIMATIC PCS neo: before 4.1

User Management Component (UMC): before 2.11.2

CPE2.3 External links

http://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU84378

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46284

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Opcenter Quality: All versions

SINUMERIK Integrate RunMyHMI /Automotive: All versions

Totally Integrated Automation Portal (TIA Portal): 14 - 18

SIMATIC PCS neo: before 4.1

User Management Component (UMC): before 2.11.2

CPE2.3 External links

http://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU84382

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46285

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Opcenter Quality: All versions

SINUMERIK Integrate RunMyHMI /Automotive: All versions

Totally Integrated Automation Portal (TIA Portal): 14 - 18

SIMATIC PCS neo: before 4.1

User Management Component (UMC): before 2.11.2

CPE2.3 External links

http://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###