sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2019-18317 Denial of service in SPPA-T3000 Application Server

High 7.5 Published Updated

An attacker with network access can cause a Denial-of-Service condition in the Siemens SPPA-T3000 Application Server by sending crafted RMI objects.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2019-18317?

CVE-2019-18317 is a high-severity denial of service vulnerability in Siemens SPPA-T3000 Application Server, published on 12 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could cause a Denial-of-Service condition by sending specifically crafted objects via RMI. This vulnerability is independent from CVE-2019-18318 and CVE-2019-18319. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

Weakness: CWE-287

Which versions are affected by CVE-2019-18317?

It affects 1 product.

Products include Siemens Sppa-T3000 Application Server.

How do I fix CVE-2019-18317?

No fix has been published for CVE-2019-18317 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-18317 being exploited?

There is no known exploitation of CVE-2019-18317 in the wild and no public exploit code.

Sources

Also known as GHSA-8c6q-359m-h9qj.

Is CVE-2019-18317 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free