CVE-2022-0223

CWE-22 — Path Traversal3 documents3 sources
Severity
9.8CRITICAL
EPSS
0.6%
top 31.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Schneider Electric Ecostruxure Power CommissionSchneider-electric Ecostruxure Power Commission
Timeline
PublishedJan 30
Latest updateJan 31

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4636-45w3-pr9q: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create o↗2023-01-31
▶
CVEList
CVE-2022-0223: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create o↗2023-01-30
▶
CVE-2022-0223 (CRITICAL CVSS 9.8) | A CWE-22: Improper Limitation of a | cvebase.io