CVE-2022-41667

CWE-22 — Path Traversal3 documents3 sources
Severity
7.8HIGH
EPSS
0.1%
top 83.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Ecostruxure Operator Terminal ExpertSchneider-electric Pro-face BlueSchneider Electric Ecostruxure Operator Terminal Expert+1 more
Timeline
PublishedNov 4

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior).

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5schneider_electric/pro-face_blueV3.3 — Hotfix 1

Patches

Patch: www.se.com ↗Patch: www.se.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wvhq-6m88-m4cx: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user↗2022-11-04
▶
CVEList
CVE-2022-41667: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user↗2022-11-04
▶
CVE-2022-41667 (HIGH CVSS 7.8) | A CWE-22: Improper Limitation of a | cvebase.io