First published: Tue Jun 14 2022(Updated: )
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.
Credit: productcert@siemens.com
Affected Software | Affected Version | How to fix |
---|---|---|
Siemens SINEMA Remote Connect Server | <3.0 | |
Siemens SINEMA Remote Connect Server | =3.0 | |
Siemens SINEMA Remote Connect Server | =3.0-sp1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2022-27220.
The severity level of CVE-2022-27220 is medium, with a CVSS score of 4.3.
All versions of SINEMA Remote Connect Server prior to V3.0 SP2 are affected, including V3.0 and V3.0 SP1.
The vulnerability could aid attackers by making the servers more prone to clickjacking and channel downgrade attacks.
Siemens has released a security advisory with recommendations to mitigate this vulnerability, which can be found at: https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf