Read the docs
TI-2020-06099 Aliases CVE-2020-7576GHSA-5778-f7p4-mgrg

Cross-site scripting in Siemens Camstar Enterprise Platform

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter Execution Core (V8.2). An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting (XSS) attacks within the vulnerable software. The impact of this attack could result in the session cookies of legitimate users being stolen. Should the attacker gain access to these cookies, they could then hijack the session and perform arbitrary actions in the name of the victim.

Why it matters now

EPSS 0.00646 51st percentileScored 2026-11-07
Fix Fixed Opcenter Execution Core (Siemens): V8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCamstar Enterprise PlatformAll versions—No fix listedCNA
SiemensOpcenter Execution Corebefore V8.2V8.2Patch availableCNA
SiemensOpcenter Execution CoreV8.2—No fix listedCNA
  • Camstar Enterprise Platform VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Opcenter Execution Core VendorSiemens Affected before V8.2 Fixed in V8.2 Patch available CNA
  • Opcenter Execution Core VendorSiemens Affected V8.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:opcenter_execution_core:*:*:*:*:*:*:*:*before 8.2VulnerableSiemens
  • cpe:2.3:a:siemens:opcenter_execution_core:*:*:*:*:*:*:*:* Versions before 8.2 Vulnerable ·Siemens

Remediation

  • Fix · CNA Opcenter Execution Core (Siemens) Fixed in V8.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7576
  2. 2026-10-03 Alias added: GHSA-5778-f7p4-mgrg
  3. 2026-10-19 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2020-06100 SQL injection in Siemens Camstar Enterprise Platform CVSS 3.1HIGH 8.1
  • TI-2020-06101 Improper access control in Siemens Camstar Enterprise Platform CVSS 3.1HIGH 8.1
  • TI-2020-17219 Insufficiently protected credentials in Siemens Opcenter Execution Core CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences