{"api_version":"1","generated_at":"2026-07-23T11:20:38+00:00","cve":"CVE-2013-4911","urls":{"html":"https://cve.report/CVE-2013-4911","api":"https://cve.report/api/cve/CVE-2013-4911.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-4911","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4911"},"summary":{"title":"CVE-2013-4911","description":"Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product.","state":"PUBLISHED","assigner":"mitre","published_at":"2013-08-01 13:32:26","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86099","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86099","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/54051","name":"http://secunia.com/advisories/54051","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA54051 - Siemens SIMATIC WinCC TIA Portal Two Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf","name":"http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Siemens","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02","name":"https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Siemens WinCC TIA Portal Vulnerabilities | ICS-CERT","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html","name":"http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SCADA StrangeLove: SSA-064884: WinCC/TIA Portal fixes","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/54252","name":"http://secunia.com/advisories/54252","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA54252 - Siemens SIMATIC WinCC TIA Portal Two Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/61536","name":"http://www.securityfocus.com/bid/61536","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Siemens SIMATIC WinCC TIA Portal CVE-2013-4911 Cross Site Request Forgery Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4911","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4911","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"4911","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"wincc","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4911","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"wincc","cpe6":"11.0","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4911","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"wincc","cpe6":"11.0","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4911","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"wincc","cpe6":"12.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T16:59:41.020Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html"},{"name":"61536","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/61536"},{"name":"simatic-cve20134911-csrf(86099)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86099"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf"},{"name":"54051","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/54051"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02"},{"name":"54252","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/54252"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-07-31T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html"},{"name":"61536","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/61536"},{"name":"simatic-cve20134911-csrf(86099)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86099"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf"},{"name":"54051","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/54051"},{"tags":["x_refsource_MISC"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02"},{"name":"54252","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/54252"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2013-4911","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html","refsource":"MISC","url":"http://scadastrangelove.blogspot.com/2013/08/ssa-064884-wincctia-portal-fixes.html"},{"name":"61536","refsource":"BID","url":"http://www.securityfocus.com/bid/61536"},{"name":"simatic-cve20134911-csrf(86099)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86099"},{"name":"http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf","refsource":"CONFIRM","url":"http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-064884.pdf"},{"name":"54051","refsource":"SECUNIA","url":"http://secunia.com/advisories/54051"},{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-13-213-02"},{"name":"54252","refsource":"SECUNIA","url":"http://secunia.com/advisories/54252"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2013-4911","datePublished":"2013-07-31T18:00:00.000Z","dateReserved":"2013-07-25T00:00:00.000Z","dateUpdated":"2024-08-06T16:59:41.020Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-08-01 13:32:26","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:wincc:11.0:*:*:*:*:*:*:*","matchCriteriaId":"D8575F81-50D2-4879-AA97-232257913BA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:wincc:11.0:sp1:*:*:*:*:*:*","matchCriteriaId":"8730C7C7-D7C7-4094-99AB-6FD06D7AAB90"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:wincc:11.0:sp2:*:*:*:*:*:*","matchCriteriaId":"F9B98FB4-A080-41DC-8B1C-DA703C8975E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:wincc:12.0:*:*:*:*:*:*:*","matchCriteriaId":"30A9D051-1796-4736-97F7-3F07917E9873"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"4911","Ordinal":"1","Title":"CVE-2013-4911","CVE":"CVE-2013-4911","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"4911","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product.","Type":"Description","Title":"CVE-2013-4911"},{"CveYear":"2013","CveId":"4911","Ordinal":"2","NoteData":"2013-07-31","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"4911","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}