Siemens OZW Web Servers Stored XSS Vulnerability (SSA-230445)

Key Information Vulnerability Description Vulnerability ID: SSA-230445 Vulnerability Type: Stored XSS (Cross-Site Scripting) Affected Product: OZW Web Servers versions before V5.2 Affected Versions: All versions < V5.2 Description: Data in the user account table is stored on the web server, allowing an attacker to inject malicious JavaScript code. This code executes when other users access the affected page, potentially with higher privileges than the attacker. Impact Scope Affected Products: OZW672 and OZW772 Web Server versions before V5.2 Affected Versions: All versions < V5.2 Remediation Update Recommendation: Upgrade to version V5.2 or later Update Links: - OZW672: https://support.industry.siemens.com/cs/ww/en/view/62567396/ - OZW772: https://support.industry.siemens.com/cs/ww/en/view/62564534/ Additional Information CVSS v3.1 Base Score: 6.8 CVSS v4.0 Base Score: 8.2 CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Reporter: Paulo Mota Contact Information: https://www.siemens.com/cert/advisories Historical Data: V1.0 (2024-11-12): Publication Date Summary SSA-230445 is a stored XSS vulnerability affecting OZW Web Servers versions prior to V5.2. The vulnerability impacts all versions of OZW672 and OZW772. The recommended fix is to upgrade to version V5.2 or later. The CVSS scores indicate a significant severity level. The vulnerability was reported by Paulo Mota, and further information can be obtained via Siemens ProductCERT.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens OZW Web Servers Stored XSS Vulnerability (SSA-230445)