PT-2022-8698 · B. Braun Melsungen Ag · Data Module Compactplus+1

Birk Kauer + 3 · Published 2022-04-14 · Updated 2022-10-21 · CVE-2020-25150

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions B. Braun Melsungen AG SpaceCom versions L81/U61 and earlier B. Braun Melsungen AG Data module compactplus versions A10 and A11

Description A relative path traversal attack allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file, an attacker can execute arbitrary commands.

Recommendations For B. Braun Melsungen AG SpaceCom versions L81/U61 and earlier, restrict access to file upload functionality until a fix is available. For B. Braun Melsungen AG Data module compactplus versions A10 and A11, consider disabling the file upload feature to prevent exploitation.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2020-25150

Affected Products

Data Module Compactplus

Spacecom

References · 4

• https://osv.dev/vulnerability/CVE-2020-25150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25150 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsma-20-296-02 · Note
• https://bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html · Note