CVE-2023-41846 - OpenCVE

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to memory corruption while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Siemens	Tecnomatix

Configuration 1 [-]

OR	cpe:2.3:a:siemens:tecnomatix::::::::
	cpe:2.3:a:siemens:tecnomatix::::::::

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: siemens

Published: 2023-09-12T09:32:36.000Z

Updated: 2023-09-12T09:32:36.000Z

Reserved: 2023-09-04T08:59:29.324Z

Link: CVE-2023-41846

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-09-12T10:15:29.880

Modified: 2023-09-14T18:00:49.853

Link: CVE-2023-41846

JSON object: View

Redhat Information

No data.

CWE

CWE-119

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:tecnomatix:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E8C9093-BD78-4ECE-9221-A889371B3839", "versionEndExcluding": "2201.0008", "versionStartIncluding": "2201", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:tecnomatix:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7103507-EE73-42FF-9DAB-37DD06467591", "versionEndExcluding": "2302.0002", "versionStartIncluding": "2302", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application is vulnerable to memory corruption while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Tecnomatix Plant Simulation V2201 (Todas las versiones < V2201.0008), Tecnomatix Plant Simulation V2302 (Todas las versiones < V2302.0002). La aplicaci\u00f3n afectada es vulnerable a la corrupci\u00f3n de la memoria al analizar archivos SPP especialmente manipulados. Esto podr\u00eda permitir a un atacante ejecutar c\u00f3digo en el contexto del proceso actual."}], "id": "CVE-2023-41846", "lastModified": "2023-09-14T18:00:49.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "productcert@siemens.com", "type": "Secondary"}]}, "published": "2023-09-12T10:15:29.880", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-764801.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "productcert@siemens.com", "type": "Primary"}]}