CVE-2024-54005 Information

Description

A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8) COMOS V10.4.0 (All versions) COMOS V10.4.1 (All versions) COMOS V10.4.2 (All versions) COMOS V10.4.3 (All versions < V10.4.3.0.47) COMOS V10.4.4 (All versions < V10.4.4.2) COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user’s system or accessible network folders by injecting malicious data into the communication channel between the two systems.

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://cert-portal.siemens.com/productcert/html/ssa-701627.html

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

5.1