Description (CNA)
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Siemens / COMOS V10.3 | affected 0 before V10.3.3.5.8 |
| Siemens / COMOS V10.4.0 | affected 0 before * |
| Siemens / COMOS V10.4.1 | affected 0 before * |
| Siemens / COMOS V10.4.2 | affected 0 before * |
| Siemens / COMOS V10.4.3 | affected 0 before V10.4.3.0.47 |
| Siemens / COMOS V10.4.4 | affected 0 before V10.4.4.2 |
| Siemens / COMOS V10.4.4.1 | affected 0 before V10.4.4.1.21 |
CWE
CWE-611
References
ADP enrichment
No English description supplied.
No references supplied.