medium6.5
CVE-2022-30694
The login endpoint /FormLogin in affected web services does not apply proper origin checking.
Impact
The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Siemens | Simatic S7-1500 Software Controller | All versions |
| Siemens | Simatic S7-Plcsim Advanced | All versions |
| Siemens | Simatic Wincc Runtime | All versions |
| Siemens | 6es7154-8fb01-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7154-8ab01-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7154-8fx00-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7151-8ab01-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7151-8fb01-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7314-6eh04-0ab0 Firmware | before 3.3.19 |
| Siemens | 6es7315-2eh14-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7315-2fj14-0ab0 Firmware | before 3.2.19 |
| Siemens | 6es7315-7tj10-0ab0 Firmware | before 3.2.19 |