PT-2019-12116 · Mitsubishi · Fr Configurator2

Publicado 2019-07-25 · Atualizado 2019-10-09 · CVE-2019-10976

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric FR Configurator2 versions 1.16S and prior

Description The issue occurs when input passed to the XML parser is not properly sanitized while parsing the XML project and/or template file (.frc2). This allows an attacker to read arbitrary files once a user opens the file.

Recommendations For versions 1.16S and prior, update to a version that includes proper sanitization of input passed to the XML parser to prevent arbitrary file reading.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-10976

Produtos afetados

Fr Configurator2

Referências · 3

• https://us-cert.gov/ics/advisories/icsa-19-204-01 · Nota
• https://osv.dev/vulnerability/CVE-2019-10976 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10976 · Nota de Segurança