{"id":"CVE-2023-46098","aliases":["EUVD-2023-50359","GHSA-qgvx-gh8h-gmqj"],"status":"published","title":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the...","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00618,"percentile":0.49897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-942"],"published":"2023-11-14T11:04:20Z","modified":"2026-06-17T06:30:09Z","products":[{"vendor":"siemens","product":"simatic pcs neo"},{"vendor":"siemens","product":"simatic_pcs_neo"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-456933.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46098"},{"url":"https://github.com/advisories/GHSA-qgvx-gh8h-gmqj"}],"sources":{"cve":[{"id":"CVE-2023-46098","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.","status":"published","published":"2023-11-14T11:04:20.174Z","modified":"2025-01-08T16:35:08.154Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50359","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.","status":"published","published":"2023-11-14T11:04:20Z","modified":"2025-01-08T16:35:08Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T00:04:23.880435Z"}],"ghsa":[{"id":"GHSA-qgvx-gh8h-gmqj","title":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the...","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.","status":"published","published":"2023-11-14T12:30:27Z","modified":"2023-11-14T12:30:35Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T14:55:00.635955Z"}],"nvd":[{"id":"CVE-2023-46098","description":"A vulnerability has been identified in SIMATIC PCS neo (All versions \u003c V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.","status":"published","published":"2023-11-14T11:15:14.553Z","modified":"2026-06-17T06:30:09.91Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T14:08:46.647045Z"}]}}