CVE-2022-24045
Summary
| CVE | CVE-2022-24045 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-20 13:15:00 UTC |
| Updated | 2023-06-23 19:48:00 UTC |
| Description | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information. |
Risk And Classification
Problem Types: NVD-CWE-Other | CWE-311
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Siemens | Desigo Dxr2 | - | All | All | All |
| Operating System | Siemens | Desigo Dxr2 Firmware | All | All | All | All |
| Hardware | Siemens | Desigo Pxc3 | - | All | All | All |
| Operating System | Siemens | Desigo Pxc3 Firmware | All | All | All | All |
| Hardware | Siemens | Desigo Pxc4 | - | All | All | All |
| Operating System | Siemens | Desigo Pxc4 Firmware | All | All | All | All |
| Hardware | Siemens | Desigo Pxc5 | - | All | All | All |
| Operating System | Siemens | Desigo Pxc5 Firmware | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| N/A | CONFIRM | cert-portal.siemens.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 590968 Siemens Desigo PXC and DXR Devices (Update A) Multiple Vulnerabilities (ICSA-22-132-10) (ssa-662649) (ssa-626968)