CVE-2021-44522
published 2021-12-14CVE-2021-44522: A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.36%
68.5th percentile
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | sipass_integrated | — | — |
| siemens | sipass_integrated | — | — |
| siemens | sipass_integrated | — | — |
| siemens | sipass_integrated_v2.76 | — | — |
| siemens | sipass_integrated_v2.80 | — | — |
| siemens | sipass_integrated_v2.85 | — | — |
| siemens | siveillance_identity | — | — |
| siemens | siveillance_identity | 1.6 – 1.6.280.0 | — |
| siemens | siveillance_identity_v1.5 | — | — |
| siemens | siveillance_identity_v1.6 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wv3w-fcvm-p52v: A vulnerability has been identified in SiPass integrated V2
ghsa_unreviewed·2021-12-15
CVE-2021-44522 [HIGH] CWE-668 GHSA-wv3w-fcvm-p52v: A vulnerability has been identified in SiPass integrated V2
A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal message broker system. This could allow an unauthenticated remote attacker to subscribe to arbitrary message queues.
CISA ICS
Siemens SiPass Integrated
cisa_ics·2021-12-16·CVSS 7.5
[HIGH] Siemens SiPass Integrated
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SiPass Integrated
Last RevisedDecember 16, 2021
Alert CodeICSA-21-350-19
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SiPass Integrated
- Vulnerabilities: Exposure of Resource to Wrong Sphere
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to access or modify several internal application resources.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Siemens SiPass integrated, an access contro
CISA ICS
Siemens Siveillance Identity
cisa_ics·2021-12-16·CVSS 7.5
[HIGH] Siemens Siveillance Identity
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Siveillance Identity
Last RevisedDecember 16, 2021
Alert CodeICSA-21-350-14
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Siveillance Identity
- Vulnerabilities: Exposure of Resource to Wrong Sphere
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to access or modify several internal application resources.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Siveillance Identity, a web-based sel
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-12-14
Published