ID
VAR-202101-1949
CVE
CVE-2020-28382
TITLE
Solid Edge Out-of-bounds Vulnerability in Microsoft
Trust: 0.8
DESCRIPTION
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in a out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. Solid Edge Is vulnerable to an out-of-bounds write.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files. Solid Edge is a combination of software tools to solve various product development processes
Trust: 2.88
IOT TAXONOMY
| category: | ['IoT'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | siemens | model: | solid edge | scope: | eq | version: | se2020 | Trust: 1.0 |
| vendor: | siemens | model: | solid edge | scope: | lt | version: | se2020 | Trust: 1.0 |
| vendor: | siemens | model: | solid edge | scope: | eq | version: | se2021 | Trust: 1.0 |
| vendor: | シーメンス | model: | solid edge | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | solid edge | scope: | eq | version: | se2021mp2 | Trust: 0.8 |
| vendor: | シーメンス | model: | solid edge | scope: | eq | version: | se2020mp12 | Trust: 0.8 |
| vendor: | siemens | model: | solid edge viewer | scope: | - | version: | - | Trust: 0.7 |
| vendor: | siemens | model: | solid edge <se2021mp2 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
buffer error
Trust: 0.6
PATCH
| title: | SSA-979834 | url: | https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf | Trust: 0.8 |
| title: | Siemens has issued an update to correct this vulnerability. | url: | https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 | Trust: 0.7 |
| title: | Patch for Solid Edge has an unspecified vulnerability (CNVD-2021-02633) | url: | https://www.cnvd.org.cn/patchInfo/show/244042 | Trust: 0.6 |
| title: | Siemens Solid Edge Buffer error vulnerability fix | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=139395 | Trust: 0.6 |
| title: | Siemens Security Advisories: Siemens Security Advisory | url: | https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=c7a8d89e21dabfae50698a81e4d34e99 | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-28382 | Trust: 3.8 |
| db: | ZDI | id: | ZDI-21-075 | Trust: 3.2 |
| db: | ICS CERT | id: | ICSA-21-012-04 | Trust: 2.5 |
| db: | SIEMENS | id: | SSA-979834 | Trust: 2.3 |
| db: | ZDI | id: | ZDI-21-052 | Trust: 1.7 |
| db: | JVN | id: | JVNVU91685542 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2020-015353 | Trust: 0.8 |
| db: | ZDI_CAN | id: | ZDI-CAN-11920 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2021-02633 | Trust: 0.6 |
| db: | AUSCERT | id: | ESB-2021.0126 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202101-920 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2020-28382 | Trust: 0.1 |
REFERENCES
| url: | https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 | Trust: 3.8 |
| url: | https://www.zerodayinitiative.com/advisories/zdi-21-075/ | Trust: 2.6 |
| url: | https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf | Trust: 2.3 |
| url: | https://www.zerodayinitiative.com/advisories/zdi-21-052/ | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-28382 | Trust: 1.4 |
| url: | https://jvn.jp/vu/jvnvu91685542/ | Trust: 0.8 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.0126/ | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/787.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
CREDITS
rgod
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-21-075 |
| db: | CNVD | id: | CNVD-2021-02633 |
| db: | VULMON | id: | CVE-2020-28382 |
| db: | JVNDB | id: | JVNDB-2020-015353 |
| db: | CNNVD | id: | CNNVD-202101-920 |
| db: | NVD | id: | CVE-2020-28382 |
LAST UPDATE DATE
2024-08-14T12:29:39.873000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-21-075 | date: | 2021-01-20T00:00:00 |
| db: | CNVD | id: | CNVD-2021-02633 | date: | 2021-01-13T00:00:00 |
| db: | VULMON | id: | CVE-2020-28382 | date: | 2021-07-15T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-015353 | date: | 2021-09-17T05:28:00 |
| db: | CNNVD | id: | CNNVD-202101-920 | date: | 2021-02-18T00:00:00 |
| db: | NVD | id: | CVE-2020-28382 | date: | 2021-12-10T21:46:34.540 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-21-075 | date: | 2021-01-20T00:00:00 |
| db: | CNVD | id: | CNVD-2021-02633 | date: | 2021-01-13T00:00:00 |
| db: | VULMON | id: | CVE-2020-28382 | date: | 2021-01-12T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-015353 | date: | 2021-09-17T00:00:00 |
| db: | CNNVD | id: | CNNVD-202101-920 | date: | 2021-01-12T00:00:00 |
| db: | NVD | id: | CVE-2020-28382 | date: | 2021-01-12T21:15:17.760 |