CVE-2022-33139 Client-side Authentication

heinz.romann · Post by **heinz.romann** » Thu Jun 23, 2022 5:23 pm

The Siemens Security Advisory recommends using server-side authentication as a solution to this problem. We still want to use client-side authentication so that we can use SSO (SingleSignOn). Will this issue be fixed with a patch?

leoknipp · Post by **leoknipp** » Thu Jun 30, 2022 9:22 am

In the linked pdf document it is described which solutions are available to avoid this issue:
https://cert-portal.siemens.com/product ... 111512.pdf

If you have further questions please get in contact with your common WinCC OA support and/or the company responsible for your project.

Best Regards
Leopold Knipp
Senior Support Specialist

AbtSIAL · Post by **AbtSIAL** » Tue Jul 05, 2022 11:18 am

Yes we are aware about this "solution". But we need a solution for SSO (SingleSignOn), which works only with client-side authentication.

leoknipp · Post by **leoknipp** » Mon Jul 11, 2022 8:29 am

Please refer also to the following article
https://support.industry.siemens.com/cs ... 0&lc=en-US

If you have further questions please get in contact with your common WinCC OA support and/or the system integrator responsible for your project.

Best Regards
Leopold Knipp
Senior Support Specialist

Security