« Volver al listado

CVE-2020-28390

Estado: ModificadaMedia (5.5)—

A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Siemens — Opcenter Execution Core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-28390",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "Opcenter Execution Core",
          "versions": [
            {
              "status": "affected",
              "version": "V8.2"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Opcenter Execution Core",
          "versions": [
            {
              "status": "affected",
              "version": "V8.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-01-12T21:15:18.043",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/",
      "tags": [
        "Not Applicable"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/",
      "tags": [
        "Not Applicable"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Opcenter Execution Core (versión V8.2), Opcenter Execution Core (versión V8.3). La aplicación contiene una vulnerabilidad de filtrado de información en el manejo de sesiones de cliente web. Un atacante local que tenga acceso al almacenamiento de sesión del cliente web podría revelar las contraseñas de los usuarios que han iniciado sesión actualmente"
    }
  ],
  "lastModified": "2026-06-17T03:10:22.027",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:opcenter_execution_core:8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19CF8C8B-5478-45C3-969F-9B3FD516F1FF"
            },
            {
              "criteria": "cpe:2.3:a:siemens:opcenter_execution_core:8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "448F0FD8-736E-4432-8520-5516D86C768D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}