mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
added CVE-2021-21000.json and CVE-2021-21001.json
This commit is contained in:
Jochen Becker
parent
951ae970f1
commit
3e3d63a163
@ -1,18 +1,247 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "info@cert.vde.com",
|
||||
"DATE_PUBLIC": "2021-05-20T10:00:00.000Z",
|
||||
"ID": "CVE-2021-21000",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "WAGO: PFC200 Denial of Service due to the number of connections to the runtime"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Series PFC200 Controller",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-823",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-829",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-831/000-00x",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-832/000-00x",
|
||||
"version_value": "FW06"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-852",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-862",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-880/0xx-xxx",
|
||||
"version_value": "FW15"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-881",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-882",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-885/0xx-xxx",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-889",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-890/0xx-xxx",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-891",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-893",
|
||||
"version_value": "FW07"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Series Ethernet Controller",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8202/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8203/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8204/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8206/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8207/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8208/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8210/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8211/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8212/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8213/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8214/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8216/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8217/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "WAGO"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-770 Allocation of Resources Without Limits or Throttling"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://cert.vde.com/en-us/advisories/vde-2021-014",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://cert.vde.com/en-us/advisories/vde-2021-014"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "VDE-2021-014",
|
||||
"defect": [
|
||||
"VDE-2021-014"
|
||||
],
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Use general security best practices to protect systems from local and network attacks.\nDo not allow direct access to the device from untrusted networks.\nUpdate to the latest firmware according to the table in chapter solutions."
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,247 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "info@cert.vde.com",
|
||||
"DATE_PUBLIC": "2021-05-20T10:00:00.000Z",
|
||||
"ID": "CVE-2021-21001",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "WAGO: PFC200 Access to files outside the home directory"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Series PFC200 Controller",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-823",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-829",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-831/000-00x",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-832/000-00x",
|
||||
"version_value": "FW06"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-852",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-862",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-880/0xx-xxx",
|
||||
"version_value": "FW15"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-881",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-882",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-885/0xx-xxx",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-889",
|
||||
"version_value": "FW14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-890/0xx-xxx",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-891",
|
||||
"version_value": "FW07"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "750-893",
|
||||
"version_value": "FW07"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Series Ethernet Controller",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8202/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8203/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8204/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8206/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8207/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8208/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8210/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8211/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8212/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8213/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8214/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8216/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "750-8217/xxx-xxx",
|
||||
"version_value": "03.06.19 (18)"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "WAGO"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.1,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://cert.vde.com/en-us/advisories/vde-2021-014",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://cert.vde.com/en-us/advisories/vde-2021-014"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "VDE-2021-014",
|
||||
"defect": [
|
||||
"VDE-2021-014"
|
||||
],
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Use general security best practices to protect systems from local and network attacks.\nDo not allow direct access to the device from untrusted networks.\nUpdate to the latest firmware according to the table in chapter solutions."
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user