CVE-2019-18997 — Improper Protection of Alternate Path in Pb610 Panel Builder 600

CWE-424 — Improper Protection of Alternate Path3 documents3 sources
Severity
7.5HIGHNVD
CNA4.3
EPSS
0.4%
top 39.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
ABB Pb610 Panel Builder 600
Timeline
PublishedDec 18
Latest updateMay 24

Description

The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working directory, thus potentially supporting unauthorized file access.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5abb/pb610_panel_builder_600unspecified — 2.8.0.424

🔴Vulnerability Details

2
GHSA
GHSA-c4x8-rwfw-m4m2: The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file↗2022-05-24
▶
CVEList
PB610 HMISimulator provides interface with access to arbitrary files↗2019-12-18
▶
CVE-2019-18997 — Improper Protection of Alternate Path | cvebase