CVE-2018-4844

{"containers": {"cna": {"affected": [{"product": "SIMATIC WinCC OA UI for Android, SIMATIC WinCC OA UI for iOS", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "SIMATIC WinCC OA UI for Android : All versions < V3.15.10"}, {"status": "affected", "version": "SIMATIC WinCC OA UI for iOS : All versions < V3.15.10"}]}], "datePublic": "2018-03-20T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache folders within the app's sandbox on the same mobile device. This includes HMI project cache folders of other configured WinCC OA servers. The security vulnerability could be exploited by an attacker who tricks an app user to connect to an attacker-controlled WinCC OA server. Successful exploitation requires user interaction and read/write access to the app's folder on a mobile device. The vulnerability could allow reading data from and writing data to the app's folder. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-03-22T09:57:01.000Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"}, {"name": "103475", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103475"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "DATE_PUBLIC": "2018-03-20T00:00:00", "ID": "CVE-2018-4844", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SIMATIC WinCC OA UI for Android, SIMATIC WinCC OA UI for iOS", "version": {"version_data": [{"version_value": "SIMATIC WinCC OA UI for Android : All versions < V3.15.10"}, {"version_value": "SIMATIC WinCC OA UI for iOS : All versions < V3.15.10"}]}}]}, "vendor_name": "Siemens AG"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache folders within the app's sandbox on the same mobile device. This includes HMI project cache folders of other configured WinCC OA servers. The security vulnerability could be exploited by an attacker who tricks an app user to connect to an attacker-controlled WinCC OA server. Successful exploitation requires user interaction and read/write access to the app's folder on a mobile device. The vulnerability could allow reading data from and writing data to the app's folder. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284: Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"}, {"name": "103475", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103475"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:18:26.503Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"}, {"name": "103475", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103475"}]}]}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2018-4844", "datePublished": "2018-03-20T14:00:00.000Z", "dateReserved": "2018-01-02T00:00:00.000Z", "dateUpdated": "2024-09-17T03:12:54.178Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "SIMATIC WinCC OA UI for Android, SIMATIC WinCC OA UI for iOS", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "SIMATIC WinCC OA UI for Android : All versions < V3.15.10"}, {"status": "affected", "version": "SIMATIC WinCC OA UI for iOS : All versions < V3.15.10"}]}], "source": "productcert@siemens.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_wincc_oa_ui:*:*:*:*:*:android:*:*", "matchCriteriaId": "29156B8C-91F4-4D5A-AC2F-8DFE4124905E", "versionEndExcluding": "3.15.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:simatic_wincc_oa_ui:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "3CD41146-AD95-4376-A13C-A8D09ABBD063", "versionEndExcluding": "3.15.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache folders within the app's sandbox on the same mobile device. This includes HMI project cache folders of other configured WinCC OA servers. The security vulnerability could be exploited by an attacker who tricks an app user to connect to an attacker-controlled WinCC OA server. Successful exploitation requires user interaction and read/write access to the app's folder on a mobile device. The vulnerability could allow reading data from and writing data to the app's folder. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC WinCC OA UI para Android (todas las versiones anteriores a V3.15.10) y SIMATIC WinCC OA UI para iOS (odas las versiones anteriores a V3.15.10). La limitaci\u00f3n insuficiente de capacidades de script CONTROL podr\u00eda permitir el acceso de lectura y escritura de una carpeta de cach\u00e9 de proyecto HMI a otras carpetas de cach\u00e9 de proyecto HMI en el sandbox de la aplicaci\u00f3n en el mismo dispositivo m\u00f3vil. Esto incluye carpetas de cach\u00e9 de proyecto HMI de otros servidores WinCC OA configurados. La vulnerabilidad de seguridad podr\u00eda ser explotada por un atacante que enga\u00f1a a un usuario de la aplicaci\u00f3n para que se conecte a un servidor WinCC OA controlado por el atacante. La explotaci\u00f3n con \u00e9xito requiere de interacci\u00f3n de usuario y acceso de lectura/escritura a la carpeta de la aplicaci\u00f3n en un dispositivo m\u00f3vil. La vulnerabilidad podr\u00eda permitir la lectura y escritura de datos en la carpeta de la aplicaci\u00f3n. En el momento de la publicaci\u00f3n del advisory, no se conoce ninguna explotaci\u00f3n p\u00fablica de la vulnerabilidad de seguridad. Siemens confirma la vulnerabilidad de seguridad y proporciona mitigaciones para resolver el problema de seguridad."}], "id": "CVE-2018-4844", "lastModified": "2026-06-17T01:59:09.377", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.4, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-20T14:29:00.477", "references": [{"source": "productcert@siemens.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103475"}, {"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"}, {"source": "nvd@nist.gov", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-081-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103475"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "productcert@siemens.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}