CVE-2024-41983 Details
Description
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application displays SQL statement in the error messages encountered during the generation of reports using Cockpit tool.
A vulnerability exists in Siemens Opcenter Quality SmartClient modules, specifically in Opcenter QL Home (SC), SOA Audit, and SOA Cockpit, all versions from 13.2 up to 2506. The issue arises because the application inadvertently reveals SQL statements in error messages when reports are generated using the Cockpit tool. This could potentially be exploited to conduct SQL injection attacks.
Users are advised to update to the latest versions of the affected SmartClient modules. Additionally, it is recommended to create custom reporting accounts that access data through views, rather than original table structures. Hardening instructions for Internet Information Services (IIS) should also be followed, including limiting the information available to end-users based on a need-to-know basis, preventing scans of database structures and configurations, and using database tools to manage reporting loads on production systems.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-382999.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| siemens opcenter quality | 13.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2025 | Initial Analysis | [email protected] |
| Aug 12, 2025 | New CVE Received | [email protected] |