RockwellCVELIST:CVE-2023-27856CVE-2023-27856 Rockwell Automation ThinManager ThinServer Path Traversal Download
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
32.0%
In affected versions, path traversal exists when processing a message of type 8
in Rockwell Automation’s ThinManager ThinServer.
An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "ThinManager ThinServer",
"vendor": "Rockwell Automation",
"versions": [
{
"status": "affected",
"version": "6.x - 10.x"
},
{
"status": "affected",
"version": "11.0.0 - 11.0.5"
},
{
"status": "affected",
"version": "11.1.0 - 11.1.5"
},
{
"status": "affected",
"version": "11.2.0 - 11.2.6"
},
{
"status": "affected",
"version": "12.0.0 - 12.0.4"
},
{
"status": "affected",
"version": "12.1.0 - 12.1.5"
},
{
"status": "affected",
"version": "13.0.0 - 13.0.1"
}
]
}
]Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
32.0%