Riskcovery

CVE-2020-25237

State
Published
Severity
Not scored
Published
Feb 9, 2021
Updated
Aug 4, 2024
Reserved
Sep 10, 2020

Read the record on cve.org

Description

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)

Scores

The record has no CVSS score.

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
SINEC NMSSiemens
  • All versions < V1.0 SP1 Update 1Affected
SINEMA ServerSiemens
  • All versions < V14.0 SP2 Update 2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.