Summary
SINEMA Remote Connect Server is affected by multiple vulnerabilities, including
- A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034)
- Several authentication bypass, privilege escalation and integrity check vulnerabilities (CVE-2022-32251 through -32261)
- A command injection vulnerability in the file upload service (CVE-2022-32262)
- A chosen-plaintext attack against HTTP over TLS ("BREACH", CVE-2022-27221)
- Information disclosure vulnerabilities in the curl component (CVE-2021-22924 through -22925)
- Several vulnerabilities in the libexpat library, that could be exploited when the server is parsing untrusted XML files (CVE-2021-45960, CVE-2021-46143, CVE-2022-22822 through -22827, CVE-2022-23852, CVE-2022-23990, CVE-2022-25235 through -25236, CVE-2022-25313 through -25315.
Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to the latest version. Note that the update also contains additional fixes for vulnerabilities documented in Siemens Security Advisories SSA-244969, SSA-539476, SSA-685781 and SSA-712929.
Vulnerabilities 29
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8CVE-2022-23852 Public exploit
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…
-
Critical 9.8CVE-2022-25235 Public exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…
-
Critical 9.8
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…
-
Critical 9.8CVE-2022-25315 Public exploit
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
-
High 8.8CVE-2021-45960 Public exploit
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentic…
-
High 8.8
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
High 7.5CVE-2022-23990 Public exploit
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
-
High 7.5CVE-2022-25314 Public exploit
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
-
Medium 6.5CVE-2022-25313 Public exploit
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not per…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The system images for instal…
-
Medium 6.1CVE-2022-29034 EPSS 29%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up wind…
-
Medium 5.9
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-th…
-
Medium 5.3
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used…
-
Medium 5.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
Medium 5.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
Medium 5.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
Medium 4.9
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input valida…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST reque…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application con…
-
Low 3.7CVE-2021-22924 Public exploit
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches…
Revision history
-
#2
Move CVE-2022-32260 to SSA-381581 as only fixed with SINEMA Remote Connect Server V3.2 SP1
-
#1
Publication Date
References
-
SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-484086.html
-
SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
-
SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-484086.txt