{"containers": {"cna": {"affected": [{"product": "Opcenter Execution Core", "vendor": "Siemens", "versions": [{"status": "affected", "version": "V8.2"}]}, {"product": "Opcenter Execution Core", "vendor": "Siemens", "versions": [{"status": "affected", "version": "V8.3"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-14T17:06:15", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2020-28390", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Opcenter Execution Core", "version": {"version_data": [{"version_value": "V8.2"}]}}, {"product_name": "Opcenter Execution Core", "version": {"version_data": [{"version_value": "V8.3"}]}}]}, "vendor_name": "Siemens"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-522: Insufficiently Protected Credentials"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/"}]}}}}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2020-28390", "datePublished": "2021-01-12T20:18:36", "dateReserved": "2020-11-10T00:00:00", "dateUpdated": "2021-01-14T17:06:15", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:opcenter_execution_core:8.2:*:*:*:*:*:*:*", "matchCriteriaId": "19CF8C8B-5478-45C3-969F-9B3FD516F1FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:opcenter_execution_core:8.3:*:*:*:*:*:*:*", "matchCriteriaId": "448F0FD8-736E-4432-8520-5516D86C768D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Opcenter Execution Core (versi\u00f3n V8.2), Opcenter Execution Core (versi\u00f3n V8.3). La aplicaci\u00f3n contiene una vulnerabilidad de filtrado de informaci\u00f3n en el manejo de sesiones de cliente web. Un atacante local que tenga acceso al almacenamiento de sesi\u00f3n del cliente web podr\u00eda revelar las contrase\u00f1as de los usuarios que han iniciado sesi\u00f3n actualmente"}], "id": "CVE-2020-28390", "lastModified": "2021-01-20T18:45:44.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-01-12T21:15:18.043", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf"}, {"source": "productcert@siemens.com", "tags": ["Not Applicable"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "productcert@siemens.com", "type": "Secondary"}]}

{}