Sign-up

ID

VAR-202301-0630


CVE

CVE-2022-43513


TITLE

Automation License Manager  Vulnerability in externally controllable references to resources in another region of

Trust: 0.8

sources: JVNDB: JVNDB-2023-001810

DESCRIPTION

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user. The Automation License Manager (ALM) centrally manages license keys for various Siemens software products. Software products that require a license key automatically report this requirement to ALM. When ALM finds a valid license key for this software, it can be used in accordance with the End User License Agreement

Trust: 2.25

sources: NVD: CVE-2022-43513 // JVNDB: JVNDB-2023-001810 // CNVD: CNVD-2023-02705 // VULHUB: VHN-440567

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-02705

AFFECTED PRODUCTS

vendor:siemensmodel:automation license managerscope:eqversion:5.1

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:6.0.9

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:5.2

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:6.0

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:5.0.0

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:5.3.4.4

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:6.0.8

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:5.3

Trust: 1.0

vendor:siemensmodel:automation license managerscope:eqversion:6.0.1

Trust: 1.0

vendor:シーメンスmodel:automation license managerscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:automation license managerscope: - version: -

Trust: 0.8

vendor:siemensmodel:automation license managerscope:eqversion:5

Trust: 0.6

vendor:siemensmodel:automation license manager sp9 upd4scope:eqversion:6<6.0

Trust: 0.6

sources: CNVD: CNVD-2023-02705 // JVNDB: JVNDB-2023-001810 // NVD: CVE-2022-43513

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-43513
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2022-43513
value: HIGH

Trust: 1.0

NVD: CVE-2022-43513
value: HIGH

Trust: 0.8

CNVD: CNVD-2023-02705
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202301-659
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-02705
severity: HIGH
baseScore: 8.5
vectorString: AV:N/AC:L/AU:N/C:N/I:C/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-43513
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

productcert@siemens.com: CVE-2022-43513
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2022-43513
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-02705 // JVNDB: JVNDB-2023-001810 // CNNVD: CNNVD-202301-659 // NVD: CVE-2022-43513 // NVD: CVE-2022-43513

PROBLEMTYPE DATA

problemtype:CWE-610

Trust: 1.1

problemtype:CWE-73

Trust: 1.1

problemtype:Externally controllable reference to another region resource (CWE-610) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-440567 // JVNDB: JVNDB-2023-001810 // NVD: CVE-2022-43513

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-659

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202301-659

PATCH

title:SSA-476715url:https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf

Trust: 0.8

title:Patch for External Control Vulnerability of Siemens Automation License Manager File Name or Pathurl:https://www.cnvd.org.cn/patchInfo/show/397246

Trust: 0.6

title:Siemens Automation License Manager Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=221645

Trust: 0.6

sources: CNVD: CNVD-2023-02705 // JVNDB: JVNDB-2023-001810 // CNNVD: CNNVD-202301-659

EXTERNAL IDS

db:NVDid:CVE-2022-43513

Trust: 3.9

db:SIEMENSid:SSA-476715

Trust: 2.3

db:SIEMENSid:SSA-556635

Trust: 1.0

db:ICS CERTid:ICSA-24-102-08

Trust: 0.8

db:ICS CERTid:ICSA-23-012-10

Trust: 0.8

db:JVNid:JVNVU90782730

Trust: 0.8

db:JVNid:JVNVU99836374

Trust: 0.8

db:JVNDBid:JVNDB-2023-001810

Trust: 0.8

db:CNVDid:CNVD-2023-02705

Trust: 0.6

db:CNNVDid:CNNVD-202301-659

Trust: 0.6

db:VULHUBid:VHN-440567

Trust: 0.1

sources: CNVD: CNVD-2023-02705 // VULHUB: VHN-440567 // JVNDB: JVNDB-2023-001810 // CNNVD: CNNVD-202301-659 // NVD: CVE-2022-43513

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf

Trust: 1.7

url:https://cert-portal.siemens.com/productcert/html/ssa-476715.html

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/html/ssa-556635.html

Trust: 1.0

url:https://jvn.jp/vu/jvnvu90782730/index.html

Trust: 0.8

url:https://jvn.jp/vu/jvnvu99836374/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-43513

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-012-10

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-08

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-43513/

Trust: 0.6

sources: CNVD: CNVD-2023-02705 // VULHUB: VHN-440567 // JVNDB: JVNDB-2023-001810 // CNNVD: CNNVD-202301-659 // NVD: CVE-2022-43513

SOURCES

db:CNVDid:CNVD-2023-02705
db:VULHUBid:VHN-440567
db:JVNDBid:JVNDB-2023-001810
db:CNNVDid:CNNVD-202301-659
db:NVDid:CVE-2022-43513

LAST UPDATE DATE

2024-08-14T12:43:39.782000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-02705date:2023-01-13T00:00:00
db:VULHUBid:VHN-440567date:2023-01-13T00:00:00
db:JVNDBid:JVNDB-2023-001810date:2024-06-27T04:48:00
db:CNNVDid:CNNVD-202301-659date:2023-01-16T00:00:00
db:NVDid:CVE-2022-43513date:2024-04-09T09:15:19.323

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-02705date:2023-01-13T00:00:00
db:VULHUBid:VHN-440567date:2023-01-10T00:00:00
db:JVNDBid:JVNDB-2023-001810date:2023-05-16T00:00:00
db:CNNVDid:CNNVD-202301-659date:2023-01-10T00:00:00
db:NVDid:CVE-2022-43513date:2023-01-10T12:15:23.207