CVE-2021-37195 - AskarLabs CVE Database

CVE-2021-37195

Vendor Siemens

Product COMOS V10.2

Weakness CWE-80 · XSS · basic

Published January 11, 2022

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS accepts arbitrary code as attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment.

Key dates

02Disclosure timeline

January 11, 2022 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-37195 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/80.html

Identifiers

CVE CVE-2021-37195

CWE CWE-80

Affected versions

Vendor Siemens

Product COMOS V10.2

Affected All versions only if web components are used

Vendor Siemens

Product COMOS V10.3

Affected All versions < V10.3.3.3 only if web components are used

Vendor Siemens

Product COMOS V10.4

Affected All versions < V10.4.1 only if web components are used