{"containers": {"cna": {"affected": [{"product": "Desigo Insight", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-21T18:09:55", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf"}, {"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2020-15792", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Desigo Insight", "version": {"version_data": [{"version_value": "All versions"}]}}]}, "vendor_name": "Siemens"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf"}, {"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05"}]}}}}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2020-15792", "datePublished": "2020-10-15T18:45:33", "dateReserved": "2020-07-15T00:00:00", "dateUpdated": "2020-10-21T18:09:55", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:desigo_insight:*:*:*:*:*:*:*:*", "matchCriteriaId": "27709FE3-EF7E-408D-9478-913FB2635E0C", "versionEndExcluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:desigo_insight:6.0:-:*:*:*:*:*:*", "matchCriteriaId": "FA232A84-E145-4E19-A093-1D77372B4B7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:desigo_insight:6.0:sp2:*:*:*:*:*:*", "matchCriteriaId": "45B6C775-F19C-4610-B7C0-337C61EB2700", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:desigo_insight:6.0:sp3:*:*:*:*:*:*", "matchCriteriaId": "2D77488A-8820-4350-980E-A09CBFEC6F97", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:desigo_insight:6.0:sp5:*:*:*:*:*:*", "matchCriteriaId": "D97D5112-D3BD-4EFA-90C3-CC00DEADFF78", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Desigo Insight (todas las versiones). El servicio web no aplica apropiadamente la comprobaci\u00f3n de entrada para algunos par\u00e1metros de consulta en un \u00e1rea reservada. Esto podr\u00eda permitir a un atacante autenticado recuperar datos por medio de un ataque de inyecci\u00f3n SQL ciego basado en contenido"}], "id": "CVE-2020-15792", "lastModified": "2022-06-15T03:15:26.893", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-15T19:15:12.767", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-226339.pdf"}, {"source": "productcert@siemens.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-287-05"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "productcert@siemens.com", "type": "Primary"}]}

{}