CVE-2022-27221: siemens sinema_remote_connect_server Observable Discrepancy

Vulnerability summary

CVE-2022-27221 is a medium (CVSS 5.9) Observable Discrepancy vulnerability in siemens sinema_remote_connect_server. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.8% of scored vulnerabilities.

Timeline

1. 14-06-2022
   PublishedVulnerability first disclosed.
2. 21-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack.

• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.