SB2023041709 - Path traversal in Triangle MicroWorks SCADA Data Gateway

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023041709

SB2023041709 - Path traversal in Triangle MicroWorks SCADA Data Gateway

Published: April 17, 2023

Security Bulletin ID SB2023041709
CSH Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2022-0369)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the Restore Workspace feature. A remote administrator can send a specially crafted HTTP request and read arbitrary files on the system, leading to arbitrary code execution.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References