PT-2023-1971 · Siemens · Tia Multiuser Server+1

CVE-2022-35868 · Publicado 2023-02-14 · Atualizado 2024-08-13

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIA Multiuser Server versions prior to V15.1 Update 8 TIA Project-Server versions prior to V1.1 TIA Project-Server V16 (All versions) TIA Project-Server V17 versions prior to V17 Update 6

Description The issue is related to an untrusted search path vulnerability. This could allow an attacker to escalate privileges by tricking a legitimate user into starting the service from an attacker-controlled path. The vulnerability is associated with the use of an untrusted search path in the software.

Recommendations For TIA Multiuser Server versions prior to V15.1 Update 8, update to V15.1 Update 8 or later. For TIA Project-Server versions prior to V1.1, update to V1.1 or later. For TIA Project-Server V16, consider disabling the service until a patch is available. For TIA Project-Server V17 versions prior to V17 Update 6, update to V17 Update 6 or later.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

BDU:2023-01585

CVE-2022-35868

Produtos afetados

Tia Multiuser Server

Tia Project-Server

Referências · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-640968.pdf · Aviso do Fabricante
• https://cisa.gov/news-events/ics-advisories/icsa-23-047-07 · Nota
• https://vuldb.com/ru/?id.220870 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-35868 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-35868 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/html/ssa-640968.html · Nota
• https://bdu.fstec.ru/vul/2023-01585 · Nota de Segurança