CSRF in Siemens Sinema Remote Connect Server
CVE-2019-13920
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cross Site Request Forgery (CSRF) attacks. The security vulnerability could be exploited by an attacker that is able to trigger requests of a logged-in user to the application. The vulnerability could allow switching the connectivity state of a user or a device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.004 (35.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Siemens Sinema_remote_connect_server — versions 2.0
- Siemens Ag Sinema Remote Connect Server — versions All versions < V2.0 SP1
Weakness classification (CWE)
References
- productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-13920?
- CVE-2019-13920 is a medium-severity vulnerability in Siemens Sinema Remote Connect Server, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2019-09-13.
- How severe is CVE-2019-13920?
- Medium severity. CVSS v3 base score is 4.3 out of 10.