PT-2022-1493 · Yokogawa · Exaopc+3

Published 2022-01-07 · Updated 2022-03-18 · CVE-2022-21808

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CENTUM CS 3000 versions from R3.08.10 to R3.09.00 CENTUM VP versions from R4.01.00 to R4.03.00 CENTUM VP versions from R5.01.00 to R5.04.20 CENTUM VP versions from R6.01.00 to R6.08.00 Exaopc versions from R3.72.00 to R3.79.00

Description A path traversal vulnerability exists in the CAMS for HIS Server, allowing an attacker to write arbitrary files due to errors in processing relative paths to directories. This issue is related to the handling of directory paths.

Recommendations For CENTUM CS 3000 versions from R3.08.10 to R3.09.00, update to a version outside of this range to mitigate the risk. For CENTUM VP versions from R4.01.00 to R4.03.00, update to a version outside of this range to mitigate the risk. For CENTUM VP versions from R5.01.00 to R5.04.20, update to a version outside of this range to mitigate the risk. For CENTUM VP versions from R6.01.00 to R6.08.00, update to a version outside of this range to mitigate the risk. For Exaopc versions from R3.72.00 to R3.79.00, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the vulnerable CAMS for HIS Server until a patch is available.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

BDU:2022-00672

CVE-2022-21808

Affected Products

Cams For His Server

Centum Cs 3000

Centum Vp

Exaopc

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-21808 · Security Note
• https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00672 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21808 · Vendor Advisory
• https://t.me/cvenotify/28091 · Telegram Post
• https://t.me/cibsecurity/38768 · Telegram Post