CVE-2023-46281

published 2023-12-12

CVE-2023-46281: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…

high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). When accessing the UMC Web-UI from affected products, UMC uses an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
siemens	opcenter_execution_foundation	< V2407	V2407
siemens	opcenter_quality	< V2312	V2312
siemens	simatic_pcs_neo	< V4.1	V4.1
siemens	simatic_pcs_neo	< 4.1	4.1
siemens	sinec_nms	< V2.0 SP1	V2.0 SP1
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	>= 14.0 < 15	15
siemens	totally_integrated_automation_portal	>= 15 < 16	16
siemens	totally_integrated_automation_portal	>= 16 < 17	17
siemens	totally_integrated_automation_portal	>= 17 < 18	18
siemens	totally_integrated_automation_portal_v14	< *	*
siemens	totally_integrated_automation_portal_v15.1	< *	*
siemens	totally_integrated_automation_portal_v16	< *	*
siemens	totally_integrated_automation_portal_v17	< V17 Update 8	V17 Update 8
siemens	totally_integrated_automation_portal_v18	< V18 Update 3	V18 Update 3

CWE-942