Details of VAR-201812-0343

ID

VAR-201812-0343

CVE

CVE-2018-13812

TITLE

plural SIMATIC Path traversal vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-014525

DESCRIPTION

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15 Update 4), SIMATIC WinCC Runtime Advanced (All versions < V15 Update 4), SIMATIC WinCC Runtime Professional (All versions < V15 Update 4), SIMATIC WinCC (TIA Portal) (All versions < V15 Update 4), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). A directory traversal vulnerability could allow to download arbitrary files from the device. The security vulnerability could be exploited by an attacker with network access to the integrated web server. No user interaction and no authentication is required to exploit the vulnerability. The vulnerability impacts the confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known. plural SIMATIC The product contains a path traversal vulnerability.Information may be obtained. Siemens SIMATIC Panels is prone to following security vulnerabilities: 1. An open-redirection vulnerability 2. A directory-traversal vulnerability Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files from the affected system in the context of the application or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site. are all HMI software used by Siemens in Germany to control and monitor machines and equipment

Trust: 1.98

sources: NVD: CVE-2018-13812 // JVNDB: JVNDB-2018-014525 // BID: 105922 // VULHUB: VHN-123909

AFFECTED PRODUCTS

vendor:	siemens	model:	simatic wincc \	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp900	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi comfort panels	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi comfort outdoor panels	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi mp	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic wincc runtime	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp400f	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp900f	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp700f	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi op	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic hmi tp	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp700	scope:	lte	version:	15.0	Trust: 1.0
vendor:	siemens	model:	simatic hmi comfort outdoor panels	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic hmi comfort panels	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp400f	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp700	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp700f	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp900	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic hmi ktp mobile panels ktp900f	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic wincc	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic wincc runtime advanced	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic wincc runtime professional	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic wincc runtime professional	scope:	eq	version:	15	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional sp1	scope:	eq	version:	14	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional	scope:	eq	version:	14	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional sp2	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional sp1 upd2	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional sp update	scope:	eq	version:	1319	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced	scope:	eq	version:	15	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced sp1 upd2	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced sp1 upd5	scope:	eq	version:	12	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced	scope:	eq	version:	12	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	simatic wincc update	scope:	eq	version:	v135	Trust: 0.3
vendor:	siemens	model:	simatic wincc sp1	scope:	eq	version:	v12	Trust: 0.3
vendor:	siemens	model:	simatic wincc	scope:	eq	version:	v120	Trust: 0.3
vendor:	siemens	model:	simatic wincc	scope:	eq	version:	v110	Trust: 0.3
vendor:	siemens	model:	simatic wincc	scope:	eq	version:	v15	Trust: 0.3
vendor:	siemens	model:	simatic wincc update	scope:	eq	version:	v136	Trust: 0.3
vendor:	siemens	model:	simatic wincc sp1	scope:	eq	version:	v13	Trust: 0.3
vendor:	siemens	model:	simatic wincc	scope:	eq	version:	v13	Trust: 0.3
vendor:	siemens	model:	simatic wincc	scope:	eq	version:	v10	Trust: 0.3
vendor:	siemens	model:	simatic hmi ktp mobile panels	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels	scope:	eq	version:	4	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels	scope:	eq	version:	22	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels	scope:	eq	version:	15	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels sp1 upd2	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels	scope:	eq	version:	13	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels sp1 upd5	scope:	eq	version:	12	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels	scope:	eq	version:	12	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort outdoor panels	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	simatic hmi classic devices	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime professional update	scope:	ne	version:	154	Trust: 0.3
vendor:	siemens	model:	simatic wincc runtime advanced update	scope:	ne	version:	154	Trust: 0.3
vendor:	siemens	model:	simatic wincc update	scope:	ne	version:	154	Trust: 0.3
vendor:	siemens	model:	simatic hmi ktp mobile panels update	scope:	ne	version:	154	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort panels update	scope:	ne	version:	154	Trust: 0.3
vendor:	siemens	model:	simatic hmi comfort outdoor panels update	scope:	ne	version:	154	Trust: 0.3

sources: BID: 105922 // JVNDB: JVNDB-2018-014525 // NVD: CVE-2018-13812

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-13812
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-13812
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201811-482
value:	HIGH
Trust: 0.6
VULHUB:	VHN-123909
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-13812
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-123909
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-13812
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-123909 // JVNDB: JVNDB-2018-014525 // CNNVD: CNNVD-201811-482 // NVD: CVE-2018-13812

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-123909 // JVNDB: JVNDB-2018-014525 // NVD: CVE-2018-13812

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201811-482

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201811-482

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014525

PATCH

title:	SSA-233109	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf	Trust: 0.8
title:	Multiple Siemens Product path traversal vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86883	Trust: 0.6

sources: JVNDB: JVNDB-2018-014525 // CNNVD: CNNVD-201811-482

EXTERNAL IDS

db:	NVD	id:	CVE-2018-13812	Trust: 2.8
db:	BID	id:	105922	Trust: 2.0
db:	SIEMENS	id:	SSA-233109	Trust: 1.7
db:	ICS CERT	id:	ICSA-18-317-08	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-014525	Trust: 0.8
db:	CNNVD	id:	CNNVD-201811-482	Trust: 0.7
db:	VULHUB	id:	VHN-123909	Trust: 0.1

sources: VULHUB: VHN-123909 // BID: 105922 // JVNDB: JVNDB-2018-014525 // CNNVD: CNNVD-201811-482 // NVD: CVE-2018-13812

REFERENCES

url:	http://www.securityfocus.com/bid/105922	Trust: 1.7
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf	Trust: 1.7
url:	https://ics-cert.us-cert.gov/advisories/icsa-18-317-08	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-13812	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-13812	Trust: 0.8
url:	http://subscriber.communications.siemens.com/	Trust: 0.3

sources: VULHUB: VHN-123909 // BID: 105922 // JVNDB: JVNDB-2018-014525 // CNNVD: CNNVD-201811-482 // NVD: CVE-2018-13812

CREDITS

Hosni Tounsi from Carthage Red Team

Trust: 0.3

sources: BID: 105922

SOURCES

db:	VULHUB	id:	VHN-123909
db:	BID	id:	105922
db:	JVNDB	id:	JVNDB-2018-014525
db:	CNNVD	id:	CNNVD-201811-482
db:	NVD	id:	CVE-2018-13812

LAST UPDATE DATE

2024-08-14T15:12:58.695000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-123909	date:	2019-10-09T00:00:00
db:	BID	id:	105922	date:	2018-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2018-014525	date:	2019-03-26T00:00:00
db:	CNNVD	id:	CNNVD-201811-482	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-13812	date:	2019-10-09T23:34:33.327

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-123909	date:	2018-12-13T00:00:00
db:	BID	id:	105922	date:	2018-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2018-014525	date:	2019-03-26T00:00:00
db:	CNNVD	id:	CNNVD-201811-482	date:	2018-11-15T00:00:00
db:	NVD	id:	CVE-2018-13812	date:	2018-12-13T16:29:00.290