CVE-2024-46892: High severity siemens sinec ins vulnerability
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing malicious actions even after their user account has been disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46892?
CVE-2024-46892 is considered a high-severity vulnerability due to its potential for unauthorized session persistence.
How do I fix CVE-2024-46892?
To fix CVE-2024-46892, upgrade your SINEC INS application to version 1.0 SP2 Update 3 or later.
What type of attack does CVE-2024-46892 allow?
CVE-2024-46892 allows authenticated attackers to continue performing actions under deleted or disabled user sessions.
Which versions of SINEC INS are affected by CVE-2024-46892?
CVE-2024-46892 affects all versions of SINEC INS prior to V1.0 SP2 Update 3.
What is the impact of CVE-2024-46892 on user permissions?
CVE-2024-46892 may lead to unauthorized access since session invalidation does not occur when user permissions are modified.