PT-2022-6466 · Unknown · Upsmon Pro

Michael Heinzl · Published 2022-08-10 · Updated 2022-11-15 · CVE-2022-38120

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions UPSMON PRO (affected versions not specified)

Description The issue is related to a path traversal vulnerability in the UPSMON PRO system, which can be exploited by a remote attacker with general user privileges to bypass authentication and access arbitrary system files. This vulnerability is associated with errors in processing relative paths to directories with limited access, allowing an attacker to circumvent security restrictions and gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01568

CVE-2022-38120

Affected Products

Upsmon Pro

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/commit/e3649b31fe709ddbc98f2c77fb14f7c9695bd222 · Exploit
• https://osv.dev/vulnerability/CVE-2022-38120 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01568 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38120 · Security Note
• https://gruppidicontinuita.eu/software/UPSmon/UPSmon_Windows_UserManual_EN.pdf · Note
• https://vuldb.com/?id.213410 · Note
• https://upspowercom.com/PRO-Windows.jsp · Note
• https://t.me/cibsecurity/52931 · Telegram Post
• https://t.me/cvenotify/37495 · Telegram Post
• https://twcert.org.tw/tw/cp-132-6679-a0695-1.html · Note