CVE-2022-22731

CWE-22 — Path Traversal3 documents3 sources
Severity
9.8CRITICAL
EPSS
0.6%
top 31.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Schneider Electric Ecostruxure Power CommissionSchneider-electric Ecostruxure Power Commission
Timeline
PublishedJan 30
Latest updateJan 31

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause path traversal attacks. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2qpf-65jf-g7q2: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attack↗2023-01-31
▶
CVEList
CVE-2022-22731: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attack↗2023-01-30
▶
CVE-2022-22731 (CRITICAL CVSS 9.8) | A CWE-22: Improper Limitation of a | cvebase.io