CVE-2012-3031: XSS
First published: Tue Sep 18 2012(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allow remote attackers to inject arbitrary web script or HTML via a (1) GET parameter, (2) POST parameter, or (3) Referer HTTP header.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SIMATIC PCS 7 | =8.0 | |
| Siemens WinCC | <=7.0 | |
| Siemens WinCC | =5.0 | |
| Siemens WinCC | =5.0-sp1 | |
| Siemens WinCC | =6.0 | |
| Siemens WinCC | =6.0-sp2 | |
| Siemens WinCC | =6.0-sp3 | |
| Siemens WinCC | =6.0-sp4 | |
| Siemens WinCC | =7.0 | |
| Siemens WinCC | =7.0-sp1 | |
| Siemens WinCC | =7.0-sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-3031?
CVE-2012-3031 is characterized as a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2012-3031?
To fix CVE-2012-3031, upgrade to Siemens WinCC version 8.0 or later, or apply any available patches provided by Siemens.
What systems are affected by CVE-2012-3031?
CVE-2012-3031 affects Siemens WinCC versions up to 7.0 SP3 and earlier, as well as Siemens Simatic PCS7.
What types of attacks are possible with CVE-2012-3031?
CVE-2012-3031 allows attackers to inject arbitrary web scripts or HTML via GET parameters, POST parameters, or the Referer HTTP header.
Can CVE-2012-3031 be exploited remotely?
Yes, CVE-2012-3031 can be exploited remotely, allowing attackers to execute scripts in the context of the affected web application.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens simatic pcs 7
- version/siemens simatic pcs 7/8.0
- canonical/siemens simatic wincc
- version/siemens simatic wincc/7.0
- version/siemens simatic wincc/5.0
- version/siemens simatic wincc/5.0-sp1
- version/siemens simatic wincc/6.0
- version/siemens simatic wincc/6.0-sp2
- version/siemens simatic wincc/6.0-sp3
- version/siemens simatic wincc/6.0-sp4
- version/siemens simatic wincc/7.0-sp1
- version/siemens simatic wincc/7.0-sp2