CVE-2019-13511 - Vulnerability Details - OpenCVE

ReportizFlow

Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Rockwellautomation	Arena

Configuration 1 [-]

cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.us-cert.gov/ics/advisories/icsa-19-213-05
https://www.zerodayinitiative.com/advisories/ZDI-20-810/
https://www.zerodayinitiative.com/advisories/ZDI-20-811/
https://www.zerodayinitiative.com/advisories/ZDI-20-812/
https://www.zerodayinitiative.com/advisories/ZDI-20-813/
https://www.zerodayinitiative.com/advisories/ZDI-20-814/

History

Tue, 17 Dec 2024 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rockwellautomation arena
CPEs	cpe:2.3:a:rockwellautomation:arena_simulation_software::::::::	cpe:2.3:a:rockwellautomation:arena::::::::
Vendors & Products	Rockwellautomation arena Simulation Software	Rockwellautomation arena

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2019-08-15T18:15:13

Updated: 2024-08-04T23:57:39.281Z

Reserved: 2019-07-11T00:00:00

Link: CVE-2019-13511

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-08-15T19:15:10.950

Modified: 2024-12-17T15:52:51.450

Link: CVE-2019-13511

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier", "vendor": "n/a", "versions": [{"status": "affected", "version": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier"}]}], "descriptions": [{"lang": "en", "value": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "INFORMATION EXPOSURE CWE-200 (CVE-2019-13511)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-07-07T16:06:05", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-05"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-814/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-810/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-811/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-813/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-812/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2019-13511", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier", "version": {"version_data": [{"version_value": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "INFORMATION EXPOSURE CWE-200 (CVE-2019-13511)"}]}]}, "references": {"reference_data": [{"name": "https://www.us-cert.gov/ics/advisories/icsa-19-213-05", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-05"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-814/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-814/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-810/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-810/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-811/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-811/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-813/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-813/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-812/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-812/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:57:39.281Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-05"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-814/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-810/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-811/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-813/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-812/"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2019-13511", "datePublished": "2019-08-15T18:15:13", "dateReserved": "2019-07-11T00:00:00", "dateUpdated": "2024-08-04T23:57:39.281Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:arena:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E10639E-C9C9-44BC-8184-041CE16114F9", "versionEndIncluding": "16.00.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation."}, {"lang": "es", "value": "Rockwell Automation Arena Simulation Software versiones 16.00.00 y anteriores, contienen una EXPOSICI\u00d3N DE INFORMACI\u00d3N CWE-200. Un archivo Arena creado con fines maliciosos abierto por parte de un usuario desprevenido puede resultar en la exposici\u00f3n limitada de la informaci\u00f3n relacionada con la estaci\u00f3n de trabajo de destino."}], "id": "CVE-2019-13511", "lastModified": "2024-12-17T15:52:51.450", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-08-15T19:15:10.950", "references": [{"source": "[email protected]", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-05"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-810/"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-811/"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-812/"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-813/"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-814/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-213-05"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-810/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-811/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-812/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-813/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-814/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "[email protected]", "type": "Primary"}]}