CVE-2021-37197: SQL Injection

Q: What is the severity of CVE-2021-37197?

The severity of CVE-2021-37197 is high with a score of 8.8.

Q: Which versions of COMOS are affected by CVE-2021-37197?

COMOS V10.2, COMOS V10.3 (versions < V10.3.3.3), and COMOS V10.4 (versions < V10.4.1) if web components are used.

Q: What is the vulnerability in COMOS V10.2, COMOS V10.3, and COMOS V10.4?

The COMOS Web component of COMOS is vulnerable to SQL injection.

Q: How can I fix CVE-2021-37197 in COMOS?

Apply the necessary patches or updates provided by Siemens to fix CVE-2021-37197 in COMOS.

Q: Where can I find more information about CVE-2021-37197?

More information about CVE-2021-37197 can be found at the Siemens CERT Portal: https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf

Published Jan 11, 2022

Updated

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.

Affected Software

3 affected components

Siemens COMOS<=10.2

Siemens COMOS>=10.3<10.3.3.3

Siemens COMOS=10.4

Remediation

Patch Available

https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf

Event History

Jan 11, 2022

CVE Published

via MITRE·11:27 AM

Data Sourced

via MITRE·11:27 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-37197?

The severity of CVE-2021-37197 is high with a score of 8.8.

Which versions of COMOS are affected by CVE-2021-37197?

COMOS V10.2, COMOS V10.3 (versions < V10.3.3.3), and COMOS V10.4 (versions < V10.4.1) if web components are used.

What is the vulnerability in COMOS V10.2, COMOS V10.3, and COMOS V10.4?