3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity, which may allow the contents of manipulated libraries to be displayed or executed. The issue also exists for source libraries, but 3S-Smart Software Solutions GmbH strongly recommends distributing compiled libraries only.
3S-Smart Software Solutions GmbH CODESYS versión V3 Library Manager, todas las versiones anteriores a la 3.5.16.0, permite que el sistema despliegue el contenido de la biblioteca activa sin comprobar su validez, lo que puede permitir que el contenido de las bibliotecas manipuladas sea mostrado o ejecutado. El problema también existe para las bibliotecas de fuente, pero 3S-Smart Software Solutions GmbH recomienda encarecidamente distribuir sólo las bibliotecas compiladas.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-79
|
| [email protected] | Primary |
en
CWE-79
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| codesys | codesys | * | <built-in method update of dict object at 0x7e60bae489c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:codesys:codesys:*:*:*:*:*:*:*:* |