CVE-2011-4878
published 2012-02-03CVE-2011-4878: Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA…
PriorityP356high7.8CVSS 2.0
AVNACLAuNCCINAN
EXPLOIT
EPSS
12.07%
95.6th percentile
Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to read arbitrary files via a ..%5c (dot dot backslash) in a URI.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_hmi_panels | — | — |
| siemens | simatic_hmi_panels | — | — |
| siemens | simatic_hmi_panels | — | — |
| siemens | simatic_hmi_panels | — | — |
| siemens | simatic_hmi_panels | — | — |
| siemens | wincc | <= v11 | — |
| siemens | wincc | — | — |
| siemens | wincc_flexible | — | — |
| siemens | wincc_flexible | — | — |
| siemens | wincc_flexible | — | — |
| siemens | wincc_flexible | — | — |
| siemens | wincc_runtime_advanced | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hcgx-xc4m-9h7x: Directory traversal vulnerability in miniweb
ghsa_unreviewed·2022-05-17
CVE-2011-4878 [HIGH] CWE-22 GHSA-hcgx-xc4m-9h7x: Directory traversal vulnerability in miniweb
Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to read arbitrary files via a ..%5c (dot dot backslash) in a URI.
CISA ICS
Siemens SIMATIC WinCC Vulnerabilities (UPDATE A)
cisa_ics·2011-12-22
Siemens SIMATIC WinCC Vulnerabilities (UPDATE A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SIMATIC WinCC Vulnerabilities (UPDATE A)
Last RevisedSeptember 06, 2018
Alert CodeICSA-12-030-01A
## Overview
This advisory is a follow-up to a previous advisory titled “ICSA-11-356-01 – Siemens HMI Authentication Vulnerabilities” that was published December 22, 2011, and an alert titled "ICS-ALERT-11-332-02A – Siemens SIMATIC WinCC Flexible Vulnerabilities" that was published December 2, 2011.
ICS-CERT has received reports from independent security researchers Billy Rios, Terry McCorkle, Shawn Merdinger, and Luigi Auriemma detailing several vulnerabilities in Siemens S
No detection rules found.
Exploit-DB
FlatnuX CMS - Traversal Arbitrary File Access
exploitdb·2012-04-01
CVE-2012-4878 FlatnuX CMS - Traversal Arbitrary File Access
FlatnuX CMS - Traversal Arbitrary File Access
---
source: https://www.securityfocus.com/bid/52846/info
Flatnux is prone to multiple security vulnerabilities:
1. An HTML-injection vulnerability
2. A cross-site request-forgery vulnerability
3. A directory-traversal vulnerability
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, obtain sensitive information, or control how the site is rendered to the user. Other attacks are also possible.
The following versions are vulnerable:
Flatnux 2011-08.09.2
Flatnux 2011-2012-01.03.3
Flatnux 2011-minimal-2012-01.03.3
Fncommerce 2010-08-09-no-db
Fncommerce 2010-08-09-no-sample-data
Fncommerce 2010-0
Exploit-DB
Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities
exploitdb·2011-11-28
CVE-2011-4879 Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities
Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities
---
#######################################################################
Luigi Auriemma
Application: Siemens SIMATIC WinCC flexible (Runtime)
http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx
Versions: 2008 SP2 + security patch 1
Platforms: Windows
Bugs: A] HmiLoad strings stack overflow
B] HmiLoad directory traversal
C] HmiLoad various Denials of Service
D] miniweb directory traversal
E] miniweb arbitrary memory read access
Exploitation: remote
Date: 28 Nov 2011
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2
Nuclei
FlatnuX CMS - Directory Traversal
nuclei·CVSS 5.0
CVE-2012-4878 [MEDIUM] FlatnuX CMS - Directory Traversal
FlatnuX CMS - Directory Traversal
A path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action.
Template:
id: CVE-2012-4878
info:
name: FlatnuX CMS - Directory Traversal
author: daffainfo
severity: medium
description: A path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action.
impact: |
An attacker can read or modify sensitive files on the server, potentially leading to unauthorized accessand data leakage.
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the directory
No writeups or analysis indexed.
http://aluigi.org/adv/winccflex_1-adv.txthttp://www.exploit-db.com/exploits/18166http://www.osvdb.org/77383http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdfhttp://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02.pdfhttp://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02A.pdfhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/71452http://aluigi.org/adv/winccflex_1-adv.txthttp://www.exploit-db.com/exploits/18166http://www.osvdb.org/77383http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdfhttp://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02.pdfhttp://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-332-02A.pdfhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-030-01.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/71452
2012-02-03
Published