PT-2019-13396 · 3S Smart Software Solutions · Codesys V3 Web Server

Publicado 2019-09-13 · Atualizado 2019-10-09 · CVE-2019-13532

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CODESYS V3 web server versions prior to 3.5.14.10

Description The issue allows an attacker to send specially crafted http or https requests to access files outside the restricted working directory of the controller.

Recommendations For versions prior to 3.5.14.10, update to version 3.5.14.10 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-13532

Produtos afetados

Codesys V3 Web Server

Referências · 3

• https://us-cert.gov/ics/advisories/icsa-19-255-01 · Correção
• https://osv.dev/vulnerability/CVE-2019-13532 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13532 · Nota de Segurança