CVE-2023-27855 Vulnerability Details

  /     /     /  

CVE-2023-27855 Metadata Quick Info

CVE Published: 21/03/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: Rockwell | Vendor: Rockwell Automation | Product: ThinManager ThinServer
Status : PUBLISHED

---

CVE-2023-27855 Description

In affected versions, a path traversal exists when processing a message in Rockwell Automation\'s ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution.

Metrics

CVSS Version: 3.1 | Base Score: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-22
CWE Name: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ( Path Traversal )
Source: Rockwell Automation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-126
CAPEC Description: CAPEC-126 Path Traversal


Source: NVD (National Vulnerability Database).