CVE-2022-40178 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2022-40178

Analyzed

More Info Official Page

Source-productcert@siemens.com

Published At-11 Oct, 2022 | 11:15

Updated At-12 Oct, 2022 | 17:17

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Improper Neutralization of Input During Web Page Generation exists in the “Import Files“ functionality of the “Operation” web application, due to the missing validation of the titles of files included in the input package. By uploading a specifically crafted graphics package, a remote low-privileged attacker can execute arbitrary JavaScript code.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

>>desigo_pxm30-1_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:desigo_pxm30-1_firmware:*:*:*:*:*:*:*:*

>>desigo_pxm30-1>>-

cpe:2.3:h:siemens:desigo_pxm30-1:-:*:*:*:*:*:*:*

>>desigo_pxm30.e_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:desigo_pxm30.e_firmware:*:*:*:*:*:*:*:*

>>desigo_pxm30.e>>-

cpe:2.3:h:siemens:desigo_pxm30.e:-:*:*:*:*:*:*:*

>>desigo_pxm40-1_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:desigo_pxm40-1_firmware:*:*:*:*:*:*:*:*

>>desigo_pxm40-1>>-

cpe:2.3:h:siemens:desigo_pxm40-1:-:*:*:*:*:*:*:*

>>desigo_pxm40.e_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:desigo_pxm40.e_firmware:*:*:*:*:*:*:*:*

>>desigo_pxm40.e>>-

cpe:2.3:h:siemens:desigo_pxm40.e:-:*:*:*:*:*:*:*

>>desigo_pxm50-1_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:desigo_pxm50-1_firmware:*:*:*:*:*:*:*:*

>>desigo_pxm50-1>>-

cpe:2.3:h:siemens:desigo_pxm50-1:-:*:*:*:*:*:*:*

>>desigo_pxm50.e_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:desigo_pxm50.e_firmware:*:*:*:*:*:*:*:*

>>desigo_pxm50.e>>-

cpe:2.3:h:siemens:desigo_pxm50.e:-:*:*:*:*:*:*:*

>>pxg3.w100-1_firmware>>Versions before 02.20.126.11-37(exclusive)

cpe:2.3:o:siemens:pxg3.w100-1_firmware:*:*:*:*:*:*:*:*

>>pxg3.w100-1>>-

cpe:2.3:h:siemens:pxg3.w100-1:-:*:*:*:*:*:*:*

>>pxg3.w100-2_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:pxg3.w100-2_firmware:*:*:*:*:*:*:*:*

>>pxg3.w100-2>>-

cpe:2.3:h:siemens:pxg3.w100-2:-:*:*:*:*:*:*:*

>>pxg3.w200-1_firmware>>Versions before 02.20.126.11-37(exclusive)

cpe:2.3:o:siemens:pxg3.w200-1_firmware:*:*:*:*:*:*:*:*

>>pxg3.w200-1>>-

cpe:2.3:h:siemens:pxg3.w200-1:-:*:*:*:*:*:*:*

>>pxg3.w200-2_firmware>>Versions before 02.20.126.11-41(exclusive)

cpe:2.3:o:siemens:pxg3.w200-2_firmware:*:*:*:*:*:*:*:*

>>pxg3.w200-2>>-

cpe:2.3:h:siemens:pxg3.w200-2:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	productcert@siemens.com

CWE ID: CWE-79

Type: Primary

Source: productcert@siemens.com

References

Hyperlink	Source	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf	productcert@siemens.com	Patch Vendor Advisory

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf

Source: productcert@siemens.com

Resource:

Patch

Vendor Advisory