PT-2017-16843 · 3S Smart Software Solutions · Codesys Web Server

David Atch · Publicado 2017-05-19 · Atualizado 2019-10-09 · CVE-2017-6027

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CODESYS Web Server versions 2.3 and prior

Description An Arbitrary File Upload issue was discovered, allowing a specially crafted web server request to upload arbitrary files to the CODESYS Web Server without authorization, potentially enabling remote code execution.

Recommendations For CODESYS Web Server versions 2.3 and prior, update to a version later than 2.3 to resolve the issue. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-6027

Produtos afetados

Codesys Web Server

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-6027 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-087-02 · Nota
• http://securityfocus.com/bid/97174 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6027 · Nota de Segurança