CVE-2016-6204
published 2016-07-22CVE-2016-6204: Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject…
PriorityP425medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.61%
73.2th percentile
Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | sinema_remote_connect_server | <= 1.1 | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEMA Remote Connect Server Cross-site Scripting Vulnerability
cisa_ics·2018-08-23
Siemens SINEMA Remote Connect Server Cross-site Scripting Vulnerability
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEMA Remote Connect Server Cross-site Scripting Vulnerability
Last RevisedAugust 23, 2018
Alert CodeICSA-16-208-03
## OVERVIEW
Researchers Antonio Morales Maldonado of INNOTEC SYSTEM, and Alexander Van Maele and Tijl Deneut of Howest have identified a cross-site scripting (XSS) vulnerability in the Siemens SINEMA Remote Connect Server application. Siemens has produced an update to mitigate this vulnerability.
This vulnerability could be exploited remotely.
## AFFECTED PRODUCTS
The following SINEMA Remote Connect Server versions are affected:
- SINEMA Remote Connect
GHSA
GHSA-rv2w-qxpc-j296: Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1
ghsa_unreviewed·2022-05-17
CVE-2016-6204 [MEDIUM] CWE-79 GHSA-rv2w-qxpc-j296: Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1
Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/92114http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-119132.pdfhttps://ics-cert.us-cert.gov/advisories/ICSA-16-208-03http://www.securityfocus.com/bid/92114http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-119132.pdfhttps://ics-cert.us-cert.gov/advisories/ICSA-16-208-03
2016-07-22
Published