CVE-2021-37197

published 2022-01-11

CVE-2021-37197: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components…

high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
siemens	comos	<= 10.2	—
siemens	comos	—	—
siemens	comos	>= 10.3 < 10.3.3.3	10.3.3.3
siemens	comos_v10.2	—	—
siemens	comos_v10.3	—	—
siemens	comos_v10.4	—	—

CWE-89