Vulnerability record · CVE-2022-29034 · published 14 June 2022

CVE-2022-29034: Siemens sinema remote connect server cross-site scripting vulnerability

Siemens · Sinema Remote Connect Server

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks.

6.1 CVSS 3.1 Medium EPSS 29% · top 1.9% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score, v2 4.3

29%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Sinema Remote Connect Server Siemens

References

Link	Tags
http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html	ExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/35	ExploitMailing ListThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-484086.html
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf	PatchVendor Advisory
http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html	ExploitMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/35	ExploitMailing ListThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-484086.html
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf	PatchVendor Advisory

Track CVE-2022-29034 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.0CVE-2021-40438Apache HTTP Server mod_proxy SSRF via crafted URI pathA crafted request URI path can make mod_proxy forward the request to an origin server chosen by the remote user, an SSRF flaw in Apache HTTP Server 2…KEVEPSS 100%analysed16 Sep 2021 9.8CVE-2022-32257Siemens sinema remote connect server improper access control vulnerabilityA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that la…EPSS 0.84%12 Mar 2024 9.8CVE-2022-32260Siemens sinema remote connect server vulnerabilityA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user creden…EPSS 0.75%14 Jun 2022 9.8CVE-2022-32262Siemens sinema remote connect server command injection vulnerabilityA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server tha…EPSS 2.6%14 Jun 2022 9.8CVE-2022-32251Siemens sinema remote connect server missing authentication for critical function vulnerabilityA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resou…EPSS 1.2%14 Jun 2022 9.8CVE-2022-25315Libexpat project libexpat integer overflow vulnerabilityIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.EPSS 4.8%18 Feb 2022 9.8CVE-2022-25235Libexpat project libexpat vulnerabilityxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a c…EPSS 5.0%16 Feb 2022 9.8CVE-2022-25236Libexpat project libexpat exposure of resource to wrong sphere vulnerabilityxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.EPSS 36%16 Feb 2022

Source: NIST National Vulnerability Database (record CVE-2022-29034), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.