CVE-2024-39865: Malicious File Upload
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of the restored file. This could allow an attacker with access to the backup encryption key to upload malicious files, that could potentially lead to remote code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39865?
CVE-2024-39865 is considered a high severity vulnerability due to its potential to allow unauthorized file restoration.
How do I fix CVE-2024-39865?
To mitigate CVE-2024-39865, it is recommended to update the SINEMA Remote Connect Server to version 3.2 SP1 or later.
What applications are affected by CVE-2024-39865?
CVE-2024-39865 affects all versions of SINEMA Remote Connect Server that are below version 3.2 SP1.
What type of attack does CVE-2024-39865 enable?
CVE-2024-39865 enables an attacker to potentially exploit file path checking issues during file restoration.
Is there an official patch for CVE-2024-39865?
Yes, Siemens has released an official patch that addresses CVE-2024-39865 in version 3.2 SP1 and later.