CVE-2016-8672 Information disclosure in n/a
The integrated web server fails to set the secure flag on cookies, potentially exposing session data during clear-text transmission.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8672?
CVE-2016-8672 is a medium-severity vulnerability in n/a, published on 23 Nov 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.
Weakness: CWE-200
Which versions are affected by CVE-2016-8672?
It affects 4 products.
Products include Siemens Simatic Cp 343-1 Firmware, Siemens Simatic Cp 443-1 Firmware, Siemens Simatic S7 300 Cpu Firmware, Siemens Simatic S7 400 Cpu Firmware.
How do I fix CVE-2016-8672?
No fix has been published for CVE-2016-8672 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-8672 being exploited?
There is no known exploitation of CVE-2016-8672 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-php6-577h-8wj4.