Summary
INTRALOG WMS before V4 is affected by vulnerabilities in the SQL Client-Server communication and in the .NET framework. Successful exploitation could allow an unauthenticated attacker located in the INTRALOG WMS network to decrypt and modify client-server communication, or potentially execute arbitrary code on the application servers.
Siemens has released a new version for INTRALOG WMS and recommends to update to the latest version.
Please contact your personal INTRALOG WMS contact person referencing the Siemens Security Advisory ID (SSA-417547) and the installed INTRALOG WMS Versions to initiate the dialog with Siemens to get the vulnerabilities fixed.
Vulnerabilities 2
-
High 8.7
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
-
Medium 6.3
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
Revision history
-
#1
Publication date
References
-
SSA-417547: Multiple Vulnerabilities in INTRALOG WMS Before V4 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-417547.html