CVE-2023-46281 - Overly Permissive Cross-domain Whitelist

Severity

88%

Complexity

27%

Confidentiality

98%

CVSS 3.1 Base Score 8.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Demo Examples

Overly Permissive Cross-domain Whitelist

CWE-942

These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:

Flash crossdomain.xml :


               
</cross-domain-policy>

Silverlight clientaccesspolicy.xml :


               
</access-policy>

These entries are far too permissive, allowing any Flash or Silverlight application to send requests. A malicious application hosted on any other web site will be able to send requests on behalf of any user tricked into executing it.

Overview

Type

Siemens

First reported 1 year ago

2023-12-12 12:15:00

Last updated 1 year ago

2023-12-14 20:22:00

Affected Software

Siemens SIMATIC PCS neo

Siemens Totally Integrated Automation Portal

References

https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-999588.pdf

Patch, Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.