CVE-2019-13532
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
El servidor web de CODESYS V3, todas las versiones anteriores a 3.5.14.10, permite a un atacante enviar peticiones http o https especialmente diseñadas que pueden conceder el acceso a archivos fuera del directorio de trabajo restringido del controlador.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-07-11 CVE Reserved
- 2019-09-13 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-19-255-01 | 2019-10-09 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Codesys Search vendor "Codesys" | Control For Beaglebone Search vendor "Codesys" for product "Control For Beaglebone" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Beaglebone" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control For Empc-a\/imx6 Search vendor "Codesys" for product "Control For Empc-a\/imx6" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Empc-a\/imx6" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control For Iot2000 Search vendor "Codesys" for product "Control For Iot2000" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Iot2000" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control For Linux Search vendor "Codesys" for product "Control For Linux" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Linux" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control For Pfc100 Search vendor "Codesys" for product "Control For Pfc100" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Pfc100" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control For Pfc200 Search vendor "Codesys" for product "Control For Pfc200" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Pfc200" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control For Raspberry Pi Search vendor "Codesys" for product "Control For Raspberry Pi" | < 3.5.14.10 Search vendor "Codesys" for product "Control For Raspberry Pi" and version " < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control Rte Search vendor "Codesys" for product "Control Rte" | >= 3.5.8.60 < 3.5.12.80 Search vendor "Codesys" for product "Control Rte" and version " >= 3.5.8.60 < 3.5.12.80" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control Rte Search vendor "Codesys" for product "Control Rte" | >= 3.5.13.0 < 3.5.14.10 Search vendor "Codesys" for product "Control Rte" and version " >= 3.5.13.0 < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control Runtime System Toolkit Search vendor "Codesys" for product "Control Runtime System Toolkit" | >= 3.0 < 3.5.12.80 Search vendor "Codesys" for product "Control Runtime System Toolkit" and version " >= 3.0 < 3.5.12.80" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control Win Search vendor "Codesys" for product "Control Win" | >= 3.5.9.80 <= 3.5.12.80 Search vendor "Codesys" for product "Control Win" and version " >= 3.5.9.80 <= 3.5.12.80" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Control Win Search vendor "Codesys" for product "Control Win" | >= 3.5.13.0 < 3.5.14.10 Search vendor "Codesys" for product "Control Win" and version " >= 3.5.13.0 < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Embedded Target Visu Toolkit Search vendor "Codesys" for product "Embedded Target Visu Toolkit" | >= 3.0 < 3.5.12.80 Search vendor "Codesys" for product "Embedded Target Visu Toolkit" and version " >= 3.0 < 3.5.12.80" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Hmi Search vendor "Codesys" for product "Hmi" | >= 3.5.10.0 < 3.5.12.80 Search vendor "Codesys" for product "Hmi" and version " >= 3.5.10.0 < 3.5.12.80" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Hmi Search vendor "Codesys" for product "Hmi" | >= 3.5.13.0 < 3.5.14.10 Search vendor "Codesys" for product "Hmi" and version " >= 3.5.13.0 < 3.5.14.10" | - |
Affected
| ||||||
| Codesys Search vendor "Codesys" | Remote Target Visu Toolkit Search vendor "Codesys" for product "Remote Target Visu Toolkit" | >= 3.0 < 3.5.12.80 Search vendor "Codesys" for product "Remote Target Visu Toolkit" and version " >= 3.0 < 3.5.12.80" | - |
Affected
| ||||||