5.3med
CVE-2019-10941
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3).
Published 5 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 58%
Public exploits
0
none known
Summary
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user identity could allow an attacker to obtain encoded system configuration backup files. This is only possible through network access to the affected system, and successful exploitation requires no system privileges.
Exploit prediction (EPSS)
0.83% probability of exploitation in the next 30 days, higher than 58% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Siemens SINEMA Server
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- cert-portal.siemens.com /productcert/pdf/ssa-835377.pdf · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-10941
- NVD: CVE-2019-10941
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.