CVE-2013-5021
ABB DataManager National Instruments Multiple ActiveX Controls cwui.ocx ExportStyle() Method Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWindows/CVI 2012 SP1 and earlier, National Instruments LabVIEW 2012 SP1 and earlier, the Data Analysis component in ABB DataManager 1 through 6.3.6, and other products allow remote attackers to create and execute arbitrary files via a full pathname in an argument to the ExportStyle method in the (1) CWNumEdit, (2) CWGraph, (3) CWBoolean, (4) CWSlide, or (5) CWKnob ActiveX control, in conjunction with file content in the (a) Caption or (b) FormatString property value.
Múltiples vulnerabilidades de salto de ruta (path) en el archivo cwui.ocx de National Instruments , como se usado en National Instruments LabWindows/CVI 2012 SP1 y anteriores, National Instruments LabVIEW 2012 SP1 y anteriores, el componente de Data Analysis en ABB DataManager versión 1 hasta 6.3.6, y otros productos permiten atacantes remotos crear y ejecutar archivos arbitrarios por medio de un acceso de ruta (path) completo en un argumento del método ExportStyle en el control de (1) CWNumEdit, (2) CWGraph, (3) CWBoolean, (4) CWSlide o (5) ActiveX CWKnob, en conjunción con el contenido del archivo en el valor de la propiedad (a) Caption o (b) FormatString.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ABB DataManager Data Analysis. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within multiple 3rd party CWUI activex controls. CWNumEdit, CWGraph, CWBoolean, CWSlide, and CWKnob all support an ExportStyle() method that allows creation of an arbitrary file with the desired extension and inside an arbitrary location. File content can be controlled by setting a 'Caption' or 'FormatString' property. This vulnerability can be leveraged by an attacker to execute code under the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-06-11 CVE Published
- 2013-07-31 CVE Reserved
- 2024-04-23 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (4)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ni Search vendor "Ni" | Labview Search vendor "Ni" for product "Labview" | <= 2012 Search vendor "Ni" for product "Labview" and version " <= 2012" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Labwindows Search vendor "Ni" for product "Labwindows" | <= 2012 Search vendor "Ni" for product "Labwindows" and version " <= 2012" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Measurementstudio Search vendor "Ni" for product "Measurementstudio" | <= 2013 Search vendor "Ni" for product "Measurementstudio" and version " <= 2013" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Teststand Search vendor "Ni" for product "Teststand" | <= 2012 Search vendor "Ni" for product "Teststand" and version " <= 2012" | - |
Affected
| ||||||
| Abb Search vendor "Abb" | Datamanager Search vendor "Abb" for product "Datamanager" | 1.0.0 Search vendor "Abb" for product "Datamanager" and version "1.0.0" | - |
Affected
| ||||||
| Abb Search vendor "Abb" | Datamanager Search vendor "Abb" for product "Datamanager" | 6.3.6 Search vendor "Abb" for product "Datamanager" and version "6.3.6" | - |
Affected
| ||||||