NVD

Id
22162  
Name
CVE-2016-8672  
Description
The integrated web server on Siemens SIMATIC CP 343-1 Advanced prior to version 3.0.53, SIMATIC CP 443-1 Advanced prior to version 3.2.17, SIMATIC S7-300 CPU, and SIMATIC S7-400 CPU devices does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-03-18  
Published
2016-11-23  
Modified Date
2017-03-16  
Seq
2016-8672  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
118286 22162 CVE-2016-8672 94460  View
118287 22162 CVE-2016-8672 http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-603476.pdf  View
118288 22162 CVE-2016-8672 https://ics-cert.us-cert.gov/advisories/ICSA-16-327-02  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
5149 JVNDB-2016-005922 複数の Siemens SIMATIC 製品の統合 Web サーバにおける Cookie をキャプチャされる脆弱性 複数の Siemens SIMATIC 製品の統合 Web サーバは、https セッションの不特定の Cookie に対して secure フラグを設定しないため、当該の Cookie をキャプチャされる脆弱性が存在します。 CVE-2016-8672 95179 CVE-2016-8672 22162 5 5.3 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005922.html 2016-11-21 2016-11-24 View