CVEvulnerability

CVE-2022-24045

6.5 MEDIUM Published 2022-05-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-311, CWE-614

Description

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.

Affected configurations

• siemens desigo dxr2 firmware (< 01.21.142.5-22) • siemens desigo pxc3 firmware (< 01.21.142.4-18) • siemens desigo pxc4 firmware (< 02.20.142.10-10884) • siemens desigo pxc5 firmware (< 02.20.142.10-10884)

Related

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness

Referenced by CWE · observed example (2)

  • CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag weakness
  • CWE-1275 Sensitive Cookie with Improper SameSite Attribute weakness

References