PT-2022-28085 · Xstream · Stream

Published 2022-12-28 · Updated 2023-01-06 · CVE-2022-4778

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions StreamX versions 6.02.01 through 6.04.34

Description The issue allows authenticated users to gain unauthorized access to files on the server's filesystem due to a path traversal vulnerability. This affects StreamX applications that use the StreamView HTML component with the public web server feature activated.

Recommendations For versions 6.02.01 through 6.04.34, consider disabling the public web server feature of the StreamView HTML component as a temporary workaround until a patch is available. Restrict access to sensitive files on the server's filesystem to minimize the risk of exploitation. Avoid using the StreamView HTML component with the public web server feature activated until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-4778

Affected Products

Stream

References · 5

• https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4778 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4778 · Vendor Advisory
• https://t.me/cvenotify/41406 · Telegram Post
• https://t.me/cvenotify/40934 · Telegram Post