PT-2013-34: Cross-Site Scripting in Siemens Simatic WinCC TIA Portal
Vulnerable software
Siemens Simatic WinCC TIA Portal
Version: 11.x
Application link:
http://www.siemens.com/
Severity level
Severity level: Medium
Impact: Cross-Site Scripting
Access Vector: Remote
CVSS v2:
Base Score: 4.3
Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVE: CVE-2013-0667
Software description
WinCC TIA Portal is part of a new, integrated engineering concept which offers a uniform engineering environment for programming and configuration of control, visualization and drive solutions.
Vulnerability description
The specialists of the Positive Research center have detected "Cross-Site Scripting" vulnerability in Siemens Simatic WinCC TIA Portal.
If a user clicks on a malicious link which seems to lead to a HMI web application, it is possible to display any data to the user (server-side script injection).
How to fix
Update your software up to the latest version
Advisory status
21.09.2012 - Vendor gets vulnerability details
15.03.2013 - Vendor releases fixed version and details
29.03.2013 - Public disclosure
Credits
The vulnerability was discovered by Artem Chaykin, Sergey Bobrov, Positive Research Center (Positive Technologies Company)
References
http://en.securitylab.ru/lab/PT-2013-34
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf
Reports on the vulnerabilities previously discovered by Positive Research:
http://ptsecurity.com/research/advisory/
http://en.securitylab.ru/lab/