sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2019-13918 Auth bypass in SINEMA Remote Connect Server

Critical 9.8 Published Updated

An attacker can gain full access to the web interface via password guessing due to missing rate limiting, requiring network access and no privileges.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2019-13918?

CVE-2019-13918 is a critical authentication bypass vulnerability in Siemens Sinema Remote Connect Server, published on 13 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing attacks. The vulnerability could be exploited by an attacker with network access to the vulnerable software, requiring no privileges and no user interaction. The vulnerability could allow full access to the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known.

Weakness: CWE-521, CWE-307

Which versions are affected by CVE-2019-13918?

It affects 1 product.

Products include Siemens Sinema Remote Connect Server.

How do I fix CVE-2019-13918?

No fix has been published for CVE-2019-13918 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-13918 being exploited?

There is no known exploitation of CVE-2019-13918 in the wild and no public exploit code.

All Siemens Sinema Remote Connect Server vulnerabilities

Sources

Also known as GHSA-hwwf-6wwf-vc9f.

Is CVE-2019-13918 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free