PT-2019-13396 · 3S Smart Software Solutions · Codesys V3 Web Server

Published 2019-09-13 · Updated 2019-10-09 · CVE-2019-13532

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CODESYS V3 web server versions prior to 3.5.14.10

Description The issue allows an attacker to send specially crafted http or https requests to access files outside the restricted working directory of the controller.

Recommendations For versions prior to 3.5.14.10, update to version 3.5.14.10 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-13532

Affected Products

Codesys V3 Web Server

References · 3

• https://us-cert.gov/ics/advisories/icsa-19-255-01 · Patch
• https://osv.dev/vulnerability/CVE-2019-13532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13532 · Security Note