Non notée
CVE-2022-24045 A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions <…
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Desigo DXR2 | Versions non publiées | |
| Desigo PXC3 | Versions non publiées | |
| Desigo PXC4 | Versions non publiées | |
| Desigo PXC5 | Versions non publiées |
Références
- cert-portal.siemens.com cert-portal.siemens.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Desigo DXR2
Les 10 CVE de Desigo DXR2 →
CVE-2026-109619
RCE via stale global state
9.2
Critique
CVE-2026-109618
RCE via OOM corruption
9.2
Critique
CVE-2026-59693
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions <…
4.3
Moyenne
CVE-2022-24044
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions <…
Non notée