« Volver al listado

CVE-2018-11455

Estado: ModificadaAlta (8.8)—

A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Siemens — Automation License Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-11455",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens AG",
          "product": "Automation License Manager 5, Automation License Manager 6",
          "versions": [
            {
              "status": "affected",
              "version": "Automation License Manager 5 : All versions < 5.3.4.4"
            },
            {
              "status": "affected",
              "version": "Automation License Manager 6 : All versions < 6.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-07T15:29:00.497",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105114",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-920962.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105114",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-920962.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Automation License Manager 5 (todas las versiones anteriores a la 5.3.4.4) y Automation License Manager 6 (todas las versiones anteriores a la 6.0.1). Una vulnerabilidad de salto de directorio podría permitir que un atacante remoto mueva archivos arbitrarios, lo que podría resultar en la ejecución de código, comprometiendo así la confidencialidad, integridad y disponibilidad del sistema. Su explotación con éxito requiere de una conexión de red al dispositivo afectado. El atacante no necesita privilegios o condiciones especiales del sistema, pero se requiere interacción del usuario."
    }
  ],
  "lastModified": "2026-06-17T01:35:58.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:automation_license_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77C00B70-5281-47EE-A86D-B891FB9DEF7B",
              "versionEndExcluding": "5.3.4.4",
              "versionStartExcluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:siemens:automation_license_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED104AAE-CD92-45C2-9B59-CD5CBA85B99F",
              "versionEndExcluding": "6.0.1",
              "versionStartIncluding": "6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}