Medium severity · published Sep 13, 2019
CVE-2019-13919
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1)
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user can also be accessed by a non-privileged user. The security vulnerability could be exploited by an attacker with network access and valid credentials for the web interface. No user interaction is required. The vulnerability could allow an attacker to access information that he should not be able to read. The affected information does not include passwords. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SR
Sinema Remote Connect Server · Siemens
through 2.0; 2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13919
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-884497.pdf
More from Sinema Remote Connect Server
9.0
CVE-2021-40438
mod_proxy SSRF
9.9
CVE-2024-39872
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)
9.8
CVE-2022-32257
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2)
9.8
CVE-2022-32262
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1)
9.8
CVE-2022-32260
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)
