PT-2017-10084 · Eaton · Eaton Epdus Eswaxx+1

Maxim Rupp · Publicado 2017-02-13 · Atualizado 2017-03-16 · CVE-2016-9357

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eaton ePDUs EAMxxx versions prior to June 30, 2015 Eaton ePDUs EMAxxx versions prior to January 31, 2014 Eaton ePDUs EAMAxx versions prior to January 31, 2014 Eaton ePDUs EMAAxx versions prior to January 31, 2014 Eaton ePDUs ESWAxx versions prior to January 31, 2014

Description An issue allows an unauthenticated attacker to access configuration files using a specially crafted URL, which enables Path Traversal.

Recommendations For EAMxxx versions prior to June 30, 2015, consider restricting access to configuration files as a mitigation measure. For EMAxxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. For EAMAxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. For EMAAxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. For ESWAxx versions prior to January 31, 2014, consider restricting access to configuration files as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-9357

Produtos afetados

Eaton Epdus Eamaxx

Eaton Epdus Eswaxx

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9357 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9357 · Aviso do Fabricante
• http://securityfocus.com/bid/95817 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-17-026-01 · Nota