CVE-2023-2913: falha de alta gravidade em Rockwell Automation ThinManager ThinServer
Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 2.4%
An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists that allows a remote actor to leverage the privileges of the server’s file system and read arbitrary files stored in it. A malicious user could exploit this vulnerability by executing a path that contains manipulating variables.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Rockwell Automation · ThinManager ThinServerCVEs relacionadas — Rockwell Automation ThinManager ThinServer
No mesmo produto, das mais perigosas para as menos.
CVE-2023-2915HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 81.8%CVE-2023-27856HIGHRockwell Automation ThinManager ThinServer Path Traversal DownloadEPSS 77.2%CVE-2023-2917CRITICALRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityEPSS 72.2%CVE-2023-2914HIGHRockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilitiyEPSS 39.9%CVE-2022-38742HIGHRockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service AttackEPSS 22.7%CVE-2023-27857HIGHRockwell Automation ThinManager ThinServer Heap-Based Buffer OverflowEPSS 18.3%