CVE-2022-2102 Vulnerability Details

  /     /     /  

CVE-2022-2102 Metadata Quick Info

CVE Published: 24/06/2022 | CVE Updated: 16/09/2024 | CVE Year: 2022
Source: icscert | Vendor: Secheron | Product: SEPCOS Control and Protection Relay firmware package
Status : PUBLISHED

---

CVE-2022-2102 Description

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.

Metrics

CVSS Version: 3.1 | Base Score: 9.4 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-841
CWE Name: CWE-841 IMPROPER ENFORCEMENT OF BEHAVIORAL WORKFLOW
Source: Secheron

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).