CVE-2020-15794 Information disclosure in Desigo Insight

Medium 4.3 Published 15 Oct 2020 Updated 4 Aug 2024

An authenticated attacker can retrieve absolute file paths from error messages in Siemens Desigo Insight, exposing host system details.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-15794?

CVE-2020-15794 is a medium-severity vulnerability in Siemens Desigo Insight, published on 15 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system.

Weakness: CWE-209, CWE-200

Which versions are affected by CVE-2020-15794?

It affects 1 product.

Products include Siemens Desigo Insight.

How do I fix CVE-2020-15794?

No fix has been published for CVE-2020-15794 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-15794 being exploited?

There is no known exploitation of CVE-2020-15794 in the wild and no public exploit code.

Sources

Also known as GHSA-c6h4-5p2h-25v8.