CVE-2022-29034: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection...

Summary

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.

This could allow attackers to perform reflected cross-site scripting (XSS) atta...

What to do

Update siemens sinema_remote_connect_server to version 3.1 or later.

Affected software

Vendor	Product	Affected versions
siemens	sinema_remote_connect_server	< 3.1 `cpe:2.3:a:siemens:sinema_remote_connect_server::::::::`

Original advisory text

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection...

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.

This could allow attackers to perform reflected cross-site scripting (XSS) attacks.

References

http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.... Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/35 Exploit Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-484086.html
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf Patch Vendor Advisory