CVE-2020-25237 Path traversal in SINEC NMS

What is CVE-2020-25237?

CVE-2020-25237 is a high-severity path traversal vulnerability in Siemens SINEC NMS, published on 9 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)

Weakness: CWE-22

Which versions are affected by CVE-2020-25237?

It affects 2 products.

Products include Siemens Sinec Network Management System, Siemens Sinema Server.

How do I fix CVE-2020-25237?

No fix has been published for CVE-2020-25237 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-25237 being exploited?

There is no known exploitation of CVE-2020-25237 in the wild and no public exploit code.

Other vulnerabilities in Siemens SINEC NMS

• CVE-2021-37201 Cross-site request forgery in SINEC NMS High 8.8
• CVE-2021-37200 Path traversal in SINEC NMS High 7.7
• CVE-2022-25311 Privilege escalation in SINEC NMS High 7.3
• CVE-2022-24281 SQL injection in SINEC NMS High 7.2
• CVE-2022-24282 Deserialization in SINEC NMS High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3xq9-pprq-hm99.