CVE-2020-15781: siemens ag sicam web firmware for sicam a8000 rtus Cross-site Scripting

Vulnerability summary

CVE-2020-15781 is a critical (CVSS 9.6) Cross-site Scripting vulnerability in siemens ag sicam web firmware for sicam a8000 rtus. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.2% of scored vulnerabilities.

Timeline

1. 14-08-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.