Severity

Medium

Analysis Summary

CVE-2020-25239

The webserver could allow unauthorized actions via special URLs for unprivileged users. The settings of the Unified Management Component (UMC) authorization server could be changed to add a rogue server by an attacker authenticating with unprivileged user rights. 

CVE-2020-25240

Unprivileged users can access services when guessing the URL. An attacker could impact availability, integrity, and gain information from logs and templates of the service.

Impact

Allow authenticated privileges

Affected Vendors

Siemens

Affected Products

SINEMA Remote Connect Server: All versions prior to v3.0

Remediation

Siemens recommends updating to v3.0 or later