PT-2023-12958 · Ronds Epm · Ronds Epm

Tsungshu Chiu · Published 2023-01-17 · Updated 2023-01-23 · CVE-2022-2893

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions RONDS EPM version 1.19.5

Description The issue is related to the improper validation of the filename parameter, which could allow an unauthorized user to specify file paths and download files.

Recommendations For RONDS EPM version 1.19.5, consider restricting access to the filename parameter to prevent unauthorized file downloads until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-2893

Affected Products

Ronds Epm

References · 6

• https://osv.dev/vulnerability/CVE-2022-2893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2893 · Security Note
• https://t.me/cibsecurity/56599 · Telegram Post
• https://t.me/cvenotify/42696 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-23-012-02 · Note
• https://t.me/cvenotify/42173 · Telegram Post