CVE-2022-3976

MZ Automation libiec61850 MMS File Services mms_client_files.c path traversal

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/iso_mms/client/mms_client_files.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.

Una vulnerabilidad ha sido encontrada en MZ Automation libiec61850 hasta 1.4 y clasificada como crítica. Esta vulnerabilidad afecta a un código desconocido del archivo src/mms/iso_mms/client/mms_client_files.c del componente MMS File Services. La manipulación del argumento nombre de archivo conduce a un path traversal. La actualización a la versión 1.5 puede solucionar este problema. El nombre del parche es 10622ba36bb3910c151348f1569f039ecdd8786f. Se recomienda actualizar el componente afectado. El identificador de esta vulnerabilidad es VDB-213556.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-11-13 CVE Reserved
2022-11-13 CVE Published
2024-06-20 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (3)

URL	Tag	Source
https://github.com/mz-automation/libiec61850	Third Party Advisory
https://vuldb.com/?id.213556	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/mz-automation/libiec61850/commit/10622ba36bb3910c151348f1569f039ecdd8786f	2022-11-18

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mz-automation Search vendor "Mz-automation"		Libiec61850 Search vendor "Mz-automation" for product "Libiec61850"				< 1.5 Search vendor "Mz-automation" for product "Libiec61850" and version " < 1.5"		-		Affected