PT-2022-3471 · Elcomplus · Elcomplus Smartics

Michael Heinzl · Published 2022-06-23 · Updated 2023-06-27 · CVE-2022-2106

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Elcomplus SmartICS version 2.3.4.0

Description The issue is related to insufficient filename validation, which allows authenticated administrator-level users to perform path traversal attacks and specify arbitrary files. This can be exploited by a remote attacker using a specially crafted HTTP request, potentially leading to the disclosure of protected information and the substitution of arbitrary files.

Recommendations For Elcomplus SmartICS version 2.3.4.0, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of administrator-level users to reduce the potential impact of a path traversal attack.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

BDU:2022-04250

CVE-2022-2106

Affected Products

Elcomplus Smartics

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-2106 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2106 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04250 · Security Note
• https://t.me/cibsecurity/45196 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022062708 · Note
• https://t.me/cvenotify/32711 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-174-05 · Note