PT-2018-15253 · Ptc · Ptc Thingworx Platform

Published 2018-12-17 · Updated 2019-07-02 · CVE-2018-20092

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PTC ThingWorx Platform versions prior to 8.3.1

Description The issue allows for a directory traversal attack on ZIP files via a POST request. This can potentially lead to unauthorized access to sensitive files and directories.

Recommendations For PTC ThingWorx Platform versions prior to 8.3.1, update to version 8.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to ZIP file handling functionality until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-20092

Affected Products

Ptc Thingworx Platform

References · 6

• https://osv.dev/vulnerability/CVE-2018-20092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20092 · Security Note
• https://ptc.com/en/documents/security/coordinated-vulnerability-disclosure/security-vulnerabilities · Vendor Advisory
• https://t.me/defcon_news/17985 · Telegram Post
• https://t.me/rnetsec/9854 · Telegram Post
• https://doyler.net/security-not-included/ptc-thingworx-vulnerability · Note