PT-2023-1361 · Unknown · Automation License Manager V5+2

Eran Jacob · Publicado 2023-01-10 · Atualizado 2024-04-09 · CVE-2022-43513

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:P

Name of the Vulnerable Software and Affected Versions Automation License Manager V5 (All versions) Automation License Manager V6 versions prior to V6.0 SP9 Upd4 TeleControl Server Basic V3 versions prior to V3.1.2

Description A vulnerability has been identified that allows an unauthenticated remote attacker to rename and move files as a SYSTEM user due to the affected components permitting the renaming of license files with user-chosen input without authentication.

Recommendations For Automation License Manager V5, consider disabling the license file renaming feature until a patch is available. For Automation License Manager V6 versions prior to V6.0 SP9 Upd4, update to V6.0 SP9 Upd4 or later to resolve the issue. For TeleControl Server Basic V3 versions prior to V3.1.2, update to V3.1.2 or later to resolve the issue. As a temporary workaround, restrict access to the license file management component to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-610

CWE-73

Identificadores relacionados

BDU:2023-00692

CVE-2022-43513

Produtos afetados

Automation License Manager V5

Automation License Manager V6

Telecontrol Server Basic V3

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-43513 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-00692 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/html/ssa-476715.html · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/html/ssa-556635.html · Nota
• https://t.me/true_secator/4046 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-43513 · Aviso do Fabricante
• https://t.me/cibsecurity/56226 · Publicação no Telegram
• https://t.me/cibsecurity/56225 · Publicação no Telegram