CVE-2020-7576: siemens opcenter execution core

csirt@kutim:~/threat-intel/cve/CVE-2020-7576

CVSS 5.4 · Medium EPSS 0,65%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada siemens opcenter execution core. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter Execution Core (V8.2). An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting (XSS) attacks within the vulnerable software. The impact of this attack could result in the session cookies of legitimate users being stolen. Should the attacker gain access to these cookies, they could then hijack the session and perform arbitrary actions in the name of the victim.

Rincian

Terbit di NVD: 14 Juli 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
siemens	opcenter execution core	Semua versi sebelum 8.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.