Sign-up

ID

VAR-202202-0373


CVE

CVE-2021-37194


TITLE

COMOS  Vulnerability in unlimited upload of dangerous types of files in

Trust: 0.8

sources: JVNDB: JVNDB-2022-005067

DESCRIPTION

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files. COMOS Contains a vulnerability related to unlimited uploads of dangerous types of files.Information may be tampered with. Siemens Comos is a plant engineering software solution from Siemens AG in Germany. For the process industry

Trust: 1.71

sources: NVD: CVE-2021-37194 // JVNDB: JVNDB-2022-005067 // VULHUB: VHN-399025

AFFECTED PRODUCTS

vendor:siemensmodel:comosscope:gteversion:10.3

Trust: 1.0

vendor:siemensmodel:comosscope:eqversion:10.2

Trust: 1.0

vendor:siemensmodel:comosscope:gteversion:10.4

Trust: 1.0

vendor:siemensmodel:comosscope:ltversion:10.3.3.3

Trust: 1.0

vendor:siemensmodel:comosscope:ltversion:10.4.1

Trust: 1.0

vendor:シーメンスmodel:comosscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:comosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-005067 // NVD: CVE-2021-37194

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37194
value: HIGH

Trust: 1.0

NVD: CVE-2021-37194
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202202-801
value: HIGH

Trust: 0.6

VULHUB: VHN-399025
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-37194
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-399025
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-37194
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-37194
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-399025 // JVNDB: JVNDB-2022-005067 // CNNVD: CNNVD-202202-801 // NVD: CVE-2021-37194

PROBLEMTYPE DATA

problemtype:CWE-434

Trust: 1.1

problemtype:Unlimited uploads of dangerous types of files (CWE-434) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-399025 // JVNDB: JVNDB-2022-005067 // NVD: CVE-2021-37194

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-801

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202202-801

PATCH

title:SSA-995338url:https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf

Trust: 0.8

title:Siemens Comos Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=181211

Trust: 0.6

sources: JVNDB: JVNDB-2022-005067 // CNNVD: CNNVD-202202-801

EXTERNAL IDS

db:NVDid:CVE-2021-37194

Trust: 3.3

db:SIEMENSid:SSA-995338

Trust: 1.7

db:JVNDBid:JVNDB-2022-005067

Trust: 0.8

db:ICS CERTid:ICSA-22-013-05

Trust: 0.6

db:AUSCERTid:ESB-2022.0602

Trust: 0.6

db:CNNVDid:CNNVD-202202-801

Trust: 0.6

db:CNVDid:CNVD-2022-56510

Trust: 0.1

db:VULHUBid:VHN-399025

Trust: 0.1

sources: VULHUB: VHN-399025 // JVNDB: JVNDB-2022-005067 // CNNVD: CNNVD-202202-801 // NVD: CVE-2021-37194

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-37194

Trust: 1.4

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-013-05

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0602

Trust: 0.6

sources: VULHUB: VHN-399025 // JVNDB: JVNDB-2022-005067 // CNNVD: CNNVD-202202-801 // NVD: CVE-2021-37194

CREDITS

Sandro Poppi reported these vulnerabilities to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202202-801

SOURCES

db:VULHUBid:VHN-399025
db:JVNDBid:JVNDB-2022-005067
db:CNNVDid:CNNVD-202202-801
db:NVDid:CVE-2021-37194

LAST UPDATE DATE

2024-08-14T13:07:41.228000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-399025date:2022-05-13T00:00:00
db:JVNDBid:JVNDB-2022-005067date:2023-05-16T08:32:00
db:CNNVDid:CNNVD-202202-801date:2022-04-13T00:00:00
db:NVDid:CVE-2021-37194date:2022-05-13T13:03:16.650

SOURCES RELEASE DATE

db:VULHUBid:VHN-399025date:2022-02-09T00:00:00
db:JVNDBid:JVNDB-2022-005067date:2023-05-16T00:00:00
db:CNNVDid:CNNVD-202202-801date:2022-02-09T00:00:00
db:NVDid:CVE-2021-37194date:2022-02-09T16:15:12.987