cve.bz

CVE-2024-46894

5.3 mediumEPSS 0.3%

Medium (5.3) in siemens sinec ins. EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a user to query the "/api/sftp/users" endpoint. This could allow an authenticated remote attacker to gain knowledge about the list of configured users of the SFTP service and also modify that configuration.

Severity

CVSS 4.0

5.3 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWEs
CWE-200, CWE-276
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON