Read the docs
TI-2020-06100 Aliases CVE-2020-7577GHSA-jv3p-j4h6-73qw

SQL injection in Siemens Camstar Enterprise Platform

Priority LOW 38CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Through the use of several vulnerable fields of the application, an authenticated user could perform an SQL Injection attack by passing a modified SQL query downstream to the back-end server. The exploit of this vulnerability could be used to read, and potentially modify application data to which the user has access to.

Why it matters now

EPSS 0.01219 68th percentileScored 2026-11-07
Fix Fixed Opcenter Execution Core (Siemens): V8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCamstar Enterprise PlatformAll versions—No fix listedCNA
SiemensOpcenter Execution Corebefore V8.2V8.2Patch availableCNA
  • Camstar Enterprise Platform VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Opcenter Execution Core VendorSiemens Affected before V8.2 Fixed in V8.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:opcenter_execution_core:*:*:*:*:*:*:*:*before 8.2VulnerableSiemens
  • cpe:2.3:a:siemens:opcenter_execution_core:*:*:*:*:*:*:*:* Versions before 8.2 Vulnerable ·Siemens

Remediation

  • Fix · CNA Opcenter Execution Core (Siemens) Fixed in V8.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7577
  2. 2026-10-03 Alias added: GHSA-jv3p-j4h6-73qw

References

Advisory 1

  • TI-2020-06101 Improper access control in Siemens Camstar Enterprise Platform CVSS 3.1HIGH 8.1
  • TI-2020-17219 Insufficiently protected credentials in Siemens Opcenter Execution Core CVSS 3.1MEDIUM 5.5
  • TI-2020-06099 Cross-site scripting in Siemens Camstar Enterprise Platform CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences