Vulnetix
Try Vulnetix Request Demo
CVE-2024-54005 PUBLISHED CVSS 5.099999904632568 MEDIUM

A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems.

EPSS 0.05% · 16.0th percentile

Risk Scores

CVSS v3.1
5.099999904632568
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.05%
16.0th percentile

Affected Products

VendorProductVersions
SiemensCOMOS V10.30
SiemensCOMOS V10.4.00
SiemensCOMOS V10.4.10
SiemensCOMOS V10.4.4.10
SiemensCOMOS V10.4.20
SiemensCOMOS V10.4.40
SiemensCOMOS V10.4.30

Timeline

References

Open in Interactive Console →