CVE-2024-36140

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36140
A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks. This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-230445.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:ozw672_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ozw672:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:ozw772_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ozw772:-:*:*:*:*:*:*:*
History

15 Nov 2024, 22:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.8 		v2 : unknown
v3 : 5.4
References () https://cert-portal.siemens.com/productcert/html/ssa-230445.html - () https://cert-portal.siemens.com/productcert/html/ssa-230445.html - Vendor Advisory
Summary
  • (es) Se ha identificado una vulnerabilidad en OZW672 (todas las versiones anteriores a la V5.2) y OZW772 (todas las versiones anteriores a la V5.2). La pestaña de cuentas de usuario de los dispositivos afectados es vulnerable a ataques de Cross Site Scripting (XSS) almacenado. Esto podría permitir que un atacante remoto autenticado inyecte código JavaScript arbitrario que luego ejecuta otro usuario víctima autenticado con posibles privilegios superiores a los del atacante.
First Time Siemens ozw672
Siemens
Siemens ozw772
Siemens ozw672 Firmware
Siemens ozw772 Firmware
CPE cpe:2.3:h:siemens:ozw772:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ozw672_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ozw772_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ozw672:-:*:*:*:*:*:*:*

12 Nov 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-12 13:15

Updated : 2024-11-15 22:53

NVD link : CVE-2024-36140

Mitre link : CVE-2024-36140

CVE.ORG link : CVE-2024-36140

JSON object : View

Products Affected

siemens

  • ozw672_firmware
  • ozw672
  • ozw772
  • ozw772_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')