CVE-2020-25237
Summary
| CVE | CVE-2020-25237 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-02-09 17:15:00 UTC |
| Updated | 2021-03-10 12:52:00 UTC |
| Description | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054) |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Siemens | Sinec Network Management System | All | All | All | All |
| Application | Siemens | Sinec Network Management System | 1.0 | - | All | All |
| Application | Siemens | Sinec Network Management System | 1.0 | sp1 | All | All |
| Application | Siemens | Sinec Network Management System | All | All | All | All |
| Application | Siemens | Sinec Network Management System | 1.0 | - | All | All |
| Application | Siemens | Sinec Network Management System | 1.0 | sp1 | All | All |
| Application | Siemens | Sinema Server | All | All | All | All |
| Application | Siemens | Sinema Server | 14.0 | - | All | All |
| Application | Siemens | Sinema Server | 14.0 | sp1 | All | All |
| Application | Siemens | Sinema Server | 14.0 | sp2 | All | All |
| Application | Siemens | Sinema Server | 14.0 | sp2_update1 | All | All |
| Application | Siemens | Sinema Server | All | All | All | All |
| Application | Siemens | Sinema Server | 14.0 | - | All | All |
| Application | Siemens | Sinema Server | 14.0 | sp1 | All | All |
| Application | Siemens | Sinema Server | 14.0 | sp2 | All | All |
| Application | Siemens | Sinema Server | 14.0 | sp2_update1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/pdf/ssa-156833.pdf | MISC | cert-portal.siemens.com | Vendor Advisory |
| ZDI-21-253 | Zero Day Initiative | MISC | www.zerodayinitiative.com | Third Party Advisory, VDB Entry |
| Siemens SINEMA Server & SINEC NMS | CISA | MISC | us-cert.cisa.gov | Third Party Advisory, US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.