CVE-2023-46098 - Overly Permissive Cross-domain Whitelist

Severity

88%

Complexity

27%

Confidentiality

98%

CVSS 3.1 Base Score 8.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Demo Examples

Overly Permissive Cross-domain Whitelist

CWE-942

These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:

Flash crossdomain.xml :


               
</cross-domain-policy>

Silverlight clientaccesspolicy.xml :


               
</access-policy>

These entries are far too permissive, allowing any Flash or Silverlight application to send requests. A malicious application hosted on any other web site will be able to send requests on behalf of any user tricked into executing it.

Overview

First reported 1 year ago

2023-11-14 11:15:00

Last updated 1 year ago

2023-11-20 14:48:00

Affected Software

Siemens SIMATIC PCS neo

References

https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf

Patch, Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.