CVE-2023-35796

published 2023-10-10

CVE-2023-35796: A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data…

critical 9 CVSS 3.1

AV N AC L PR L UI R S C C H I H A H

A vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting (XSS) attack that may lead to arbitrary code execution with `SYSTEM` privileges on the application server. (ZDI-CAN-19823)

Affected

2 ranges

Vendor	Product	Version range	Fixed in
siemens	sinema_server	—	—
siemens	sinema_server_v14	—	—

CWE-79