// For flags

CVE-2022-2464

ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the ISaGRAF Workbench software. User interaction is required for this exploit to be successful.

Rockwell Automation ISaGRAF Workbench software versiones 6.0 hasta 6.6.9, están afectadas por una vulnerabilidad de Salto de Ruta. Los archivos maliciosos diseñados pueden permitir a un atacante atravesar el sistema de archivos cuando son abiertos por ISaGRAF Workbench. Si es explotado con éxito, un atacante podría sobrescribir los archivos existentes y crear archivos adicionales con los mismos permisos del software ISaGRAF Workbench. Es requerida una interacción del usuario para que la explotación tenga éxito.

*Credits: Mashav Sapir of Claroty Research reported these vulnerabilities to Rockwell Automation and CISA.
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-07-18 CVE Reserved
  • 2022-08-25 CVE Published
  • 2024-03-17 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-03 2022-08-27
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rockwellautomation
Search vendor "Rockwellautomation"
 Isagraf Workbench
Search vendor "Rockwellautomation" for product "Isagraf Workbench"
 >= 6.0 <= 6.6.9
Search vendor "Rockwellautomation" for product "Isagraf Workbench" and version " >= 6.0 <= 6.6.9"
-
Affected