Lucene search
PRIOn knowledge basePRION:CVE-2023-2913HistoryJul 18, 2023 - 8:15 p.m.
Path traversal
2023-07-1820:15:00
PRIOn knowledge base
www.prio-n.com
4
rockwell automation thinmanager
thinserver
api feature
https server settings
path traversal vulnerability
remote actor
file system
arbitrary files
malicious user
An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists that allows a remote actor to leverage the privileges of the server’s file system and read arbitrary files stored in it. A malicious user could exploit this vulnerability by executing a path that contains manipulating variables.
| CPE | Name | Operator | Version |
|---|---|---|---|
| thinmanager | ge | 13.0.0 | |
| thinmanager | le | 13.0.2 |
Related
cve
cve
CVE-2023-2913
2023-07-18 20:15:09
ics
ics
Rockwell Automation ThinManager ThinServer
2023-07-25 12:00:00
cvelist
cvelist
nvd
nvd
CVE-2023-2913
2023-07-18 20:15:09