CVE-2017-6020

🗓️ 17 Apr 2018 14:00:00Reported by icscertType

cve🔗 web.nvd.nist.gov👁 66 Views🌐 WEB

Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level

Reporter	Title	Published	Views	Family All 10
0day.today	LAquis SCADA 4.1.0.2385 - Directory Traversal Exploit	28 Sep 201700:00	–	zdt
Cvelist	CVE-2017-6020	17 Apr 201814:00	–	cvelist
Exploit DB	LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)	27 Sep 201700:00	–	exploitdb
EUVD	EUVD-2017-15088	7 Oct 202500:30	–	euvd
exploitpack	LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)	27 Sep 201700:00	–	exploitpack
ICS	LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA	23 Mar 201700:00	–	ics
NVD	CVE-2017-6020	17 Apr 201814:29	–	nvd
Packet Storm	LAquis SCADA 4.1.0.2385 Directory Traversal	29 Sep 201700:00	–	packetstorm
Prion	Design/Logic Flaw	17 Apr 201814:29	–	prion
Zero Day Initiative	LAquis SCADA Software Web Server Directory Traversal Information Disclosure Vulnerability	12 Apr 201700:00	–	zdi

NVD

Vulners

Node

lcds laquis_scadaRange<4.1.0.3237

[
  {
    "product": "LAquis SCADA software",
    "vendor": "LCDS - LeÃ£o Consultoria e Desenvolvimento de Sistemas LTDA ME",
    "versions": [
      {
        "status": "affected",
        "version": "versions prior to version 4.1.0.3237"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/42885/
securityfocus	www.securityfocus.com/bid/97055
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-17-082-01

Parameter	Position	Path	Description	CWE
NOME	query param	listagem.laquis	Directory traversal leading to information disclosure via NOME parameter in listagem.laquis	CWE-22

21 Nov 2024 03:28Current

5.3Medium risk

Vulners AI Score5.3

CVSS 24

CVSS 35.3

EPSS0.06683

CWE-22