{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-24045",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-24045",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2022-05-10T09:46:56.000Z",
    "updatedAt": "2024-08-03T03:59:23.659Z",
    "importedAt": "2026-10-24T01:56:40.826Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": null,
      "summary": "A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.",
      "affected": [
        {
          "vendor": "Siemens",
          "product": "Desigo DXR2",
          "versions": [
            {
              "version": "All versions < V01.21.142.5-22",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Desigo PXC3",
          "versions": [
            {
              "version": "All versions < V01.21.142.4-18",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Desigo PXC4",
          "versions": [
            {
              "version": "All versions < V02.20.142.10-10884",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Desigo PXC5",
          "versions": [
            {
              "version": "All versions < V02.20.142.10-10884",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}