PT-2022-24993 · Mz Automation+1 · Libiec61850+1

Mzillgit · Published 2021-09-23 · Updated 2024-08-19 · CVE-2022-3976

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MZ Automation libiec61850 versions up to 1.4

Description A critical issue has been found in the MMS File Services component, specifically affecting the file src/mms/iso mms/client/mms client files.c. The manipulation of the filename argument leads to path traversal. Upgrading to version 1.5 addresses this issue.

Recommendations For MZ Automation libiec61850 versions up to 1.4, upgrade to version 1.5 to resolve the issue. As a temporary workaround, consider restricting access to the mms client files.c file until the upgrade is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2021-2864

ALT-PU-2024-11160

CVE-2022-3976

Affected Products

Alt Linux

Libiec61850

References · 6

• https://github.com/mz-automation/libiec61850/commit/10622ba36bb3910c151348f1569f039ecdd8786f · Patch
• https://osv.dev/vulnerability/CVE-2022-3976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3976 · Security Note
• https://github.com/mz-automation/libiec61850 · Note
• https://vuldb.com/?id.213556 · Note
• https://t.me/cvenotify/37597 · Telegram Post