PT-2023-1360 · Unknown · Automation License Manager V5+2

Eran Jacob · Publicado 2023-01-10 · Atualizado 2024-04-09 · CVE-2022-43514

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Automation License Manager V5 (All versions) Automation License Manager V6 (All versions prior to V6.0 SP9 Upd4) TeleControl Server Basic V3 (All versions prior to V3.1.2)

Description The issue is related to a path traversal vulnerability. It may allow a remote attacker to execute arbitrary code. The affected component does not correctly validate the root path on folder-related operations, allowing modification of files and folders outside the intended root directory. This could enable an unauthenticated remote attacker to execute file operations on files outside of the specified root folder.

Recommendations For Automation License Manager V5, update to a version that includes the necessary security fixes. For Automation License Manager V6, update to V6.0 SP9 Upd4 or later. For TeleControl Server Basic V3, update to V3.1.2 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-00691

CVE-2022-43514

Produtos afetados

Automation License Manager V5

Automation License Manager V6

Telecontrol Server Basic V3

Referências · 8

• https://osv.dev/vulnerability/CVE-2022-43514 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/html/ssa-476715.html · Nota
• https://bdu.fstec.ru/vul/2023-00691 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/html/ssa-556635.html · Nota
• https://t.me/true_secator/4046 · Publicação no Telegram
• https://t.me/cibsecurity/56226 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-43514 · Nota de Segurança