« Volver al listado

CVE-2021-37197

Estado: ModificadaAlta (8.8)—

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Siemens — Comos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-37197",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "COMOS V10.2",
          "versions": [
            {
              "status": "affected",
              "version": "All versions only if web components are used"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "COMOS V10.3",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V10.3.3.3 only if web components are used"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "COMOS V10.4",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V10.4.1 only if web components are used"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-11T12:15:09.930",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en COMOS V10.2 (Todas las versiones sólo si se utilizan componentes web), COMOS V10.3 (Todas las versiones anteriores a V10.3.3.3 sólo si se utilizan componentes web), COMOS V10.4 (Todas las versiones anteriores a V10.4.1 sólo si se utilizan componentes web). El componente COMOS Web de COMOS es vulnerable a inyecciones SQL. Esto podría permitir a un atacante ejecutar sentencias SQL arbitrarias."
    }
  ],
  "lastModified": "2026-06-17T04:00:14.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28970CC4-B11E-4B5A-88D2-CA6528CAB36A",
              "versionEndIncluding": "10.2"
            },
            {
              "criteria": "cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4E2BA1A-7CCB-4785-82A3-27E21B83B0AB",
              "versionEndExcluding": "10.3.3.3",
              "versionStartIncluding": "10.3"
            },
            {
              "criteria": "cpe:2.3:a:siemens:comos:10.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDF6D202-6CF1-4B97-8386-AC05DBA41C5F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}