PT-2021-23473 · Siemens · Simatic Easie Pcs 7 Skill Package

Published 2021-12-14 · Updated 2021-12-17 · CVE-2021-42022

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC eaSie PCS 7 Skill Package versions prior to V21.00 SP3

Description A vulnerability has been identified where the affected systems do not properly neutralize special elements within the pathname when downloading files. This could allow an attacker to cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default.

Recommendations For versions prior to V21.00 SP3, update to version V21.00 SP3 or later to resolve the issue. As a temporary workaround, consider keeping the affected file download function disabled until a patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-42022

Affected Products

Simatic Easie Pcs 7 Skill Package

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-42022 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42022 · Vendor Advisory