CVE-2022-34836
Assigner: ABB
Published: 2022-07-26T00:00:00
State: PUBLISHED
affected: product: ABB Zenon
vendor: ABB
versions: lessThanOrEqual: 8.20
status: affected
version: unspecified
versionType: custom
credits: value: ABB thanks Ruben Santamarta for helping to identify the vulnerabilities and protecting our customers
datePublic: 2022-07-26T00:00:00
descriptions: value: Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon runtime activities such as the start and stop of various activity and the last error code etc.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-23
description: CWE-23 Relative Path Traversal
type: CWE
source: discovery: UNKNOWN
title: ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
x_generator: engine: Vulnogram 0.0.9