Siemens SIMATIC S7-1500 CVE-2014-2246 Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	66201
Class:	Input Validation Error
CVE:	CVE-2014-2246
Remote:	Yes
Local:	No
Published:	Mar 12 2014 12:00AM
Updated:	Mar 19 2014 02:13AM
Credit:	Dmitry Serebryannikov, Ilya Karpov, Alexey Osipov, Yury Goltsev, Alex Timorin, Alexey Osipov, and Ilya Karpov from Positive Technologies.
Vulnerable:
Not Vulnerable:

Siemens SIMATIC S7-1500 CVE-2014-2246 Unspecified Cross Site Scripting Vulnerability

Siemens SIMATIC S7-1500 is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to SIMATIC S7-1500 1.5.0 are vulnerable.

Siemens SIMATIC S7-1500 CVE-2014-2246 Unspecified Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

Siemens SIMATIC S7-1500 CVE-2014-2246 Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Siemens SIMATIC S7-1500 CVE-2014-2246 Unspecified Cross Site Scripting Vulnerability

References:

• Siemens Homepage (Siemens)