PT-2023-1360 · Unknown · Automation License Manager V5+2

Eran Jacob · Published 2023-01-10 · Updated 2024-04-09 · CVE-2022-43514

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Automation License Manager V5 (All versions) Automation License Manager V6 (All versions prior to V6.0 SP9 Upd4) TeleControl Server Basic V3 (All versions prior to V3.1.2)

Description The issue is related to a path traversal vulnerability. It may allow a remote attacker to execute arbitrary code. The affected component does not correctly validate the root path on folder-related operations, allowing modification of files and folders outside the intended root directory. This could enable an unauthenticated remote attacker to execute file operations on files outside of the specified root folder.

Recommendations For Automation License Manager V5, update to a version that includes the necessary security fixes. For Automation License Manager V6, update to V6.0 SP9 Upd4 or later. For TeleControl Server Basic V3, update to V3.1.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-00691

CVE-2022-43514

Affected Products

Automation License Manager V5

Automation License Manager V6

Telecontrol Server Basic V3

References · 8

• https://osv.dev/vulnerability/CVE-2022-43514 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00691 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43514 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-476715.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-556635.html · Note
• https://t.me/true_secator/4046 · Telegram Post
• https://t.me/cibsecurity/56226 · Telegram Post