A vulnerability classified as problematic was found in Pilz PMC Programming Tool up to 3.5.16. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.

The weakness was released 12/27/2022 as VDE-2021-061. The advisory is shared for download at cert.vde.com. This vulnerability was named CVE-2019-9011 since 02/22/2019. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 3.5.17 eliminates this vulnerability.

Productinfo

Vendor

• Pilz

Name

• PMC Programming Tool

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 3.5.14
• 3.5.15
• 3.5.16

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion