ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 (Rockwell Automation ISaGRAF Workbench)
En bref
- Source
- NVD
- EPSS
- EPSS 2.78 % · centile 86 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- icscert
- Statut NVD
- Modified
Description
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | icscert |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | NVD · ics-cert@hq.dhs.gov (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-34724
- GCVE · GCVE-0-2022-2463
Avis du CERT-FR
- CERTFR-2022-AVI-896 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:rockwellautomation:isagraf_workbench:*:*:*:*:*:*:*:*≥ 6.0 ≤ 6.6.9
Produits affectés
| Produit | Versions |
|---|---|
| Rockwell Automation · ISaGRAF Workbench | affected 6.0 ≤ 6.6.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |