CVE-2019-10941

CWE-306 — Missing Authentication3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.2%
top 59.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Siemens Sinema Server
Timeline
PublishedSep 14
Latest updateMay 24

Description

A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user identity could allow an attacker to obtain encoded system configuration backup files. This is only possible through network access to the affected system, and successful exploitation requires no system privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDsiemens/sinema_server< 14.0+1
▶CVEListV5siemens/sinema_serverAll versions < V14 SP3

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-69h3-7gjf-m5gx: A vulnerability has been identified in SINEMA Server (All versions < V14 SP3)↗2022-05-24
▶
CVEList
CVE-2019-10941: A vulnerability has been identified in SINEMA Server (All versions < V14 SP3)↗2021-09-14
▶