Medium severity · published Sep 14, 2021
CVE-2019-10941
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3)
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user identity could allow an attacker to obtain encoded system configuration backup files. This is only possible through network access to the affected system, and successful exploitation requires no system privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Sinema Server · Siemens
before 14.0; 14.0; 14.0; 14.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10941
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10941
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-835377.pdf
More from Sinema Server
9.0
CVE-2021-40438
mod_proxy SSRF
9.9
CVE-2019-10940
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1)
9.8
CVE-2021-39275
ap_escape_quotes() may write beyond the end of a buffer when given malicious input
9.0
CVE-2023-35796
A vulnerability has been identified in SINEMA Server V14 (All versions)
8.1
CVE-2020-25237
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2)