cvelist/2019/13xxx/CVE-2019-13933.json

{
    "CVE_data_meta": {
        "ASSIGNER": "productcert@siemens.com",
        "ID": "CVE-2019-13933",
        "STATE": "PUBLIC"
    },
    "data_format": "MITRE",
    "data_version": "4.0",
    "data_type": "CVE",
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Siemens AG",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "SCALANCE X-200RNA switch family",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "All versions"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "All versions < V4.1.3"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-306: Missing Authentication for Critical Function"
                    }
                ]
            }
        ]
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). Affected devices contain a vulnerability that allows an unauthenticated attacker to violate access-control rules. The vulnerability can be triggered by sending GET request to specific uniform resource locator on the web configuration interface of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. An attacker could use the vulnerability to obtain sensitive information or change the device configuration. At the time of advisory publication no public exploitation of this security vulnerability was known."
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "refsource": "CONFIRM",
                "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf",
                "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf"
            },
            {
                "refsource": "MISC",
                "name": "https://www.us-cert.gov/ics/advisories/icsa-20-014-03",
                "url": "https://www.us-cert.gov/ics/advisories/icsa-20-014-03"
            }
        ]
    }
}