Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.
Rockwell Automation ISaGRAF Workbench software versiones 6.0 hasta 6.6.9, están afectadas por una vulnerabilidad de Salto de Ruta. Un archivo de intercambio .7z mal diseñado puede permitir a un atacante obtener los privilegios del software ISaGRAF Workbench cuando es abierto. Si el software es ejecutado en el nivel SYSTEM, el atacante obtendrá privilegios de nivel de administrador. Es requerida una interacción del usuario para que la explotación tenga éxito.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-22
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| rockwellautomation | isagraf_workbench | * | <built-in method update of dict object at 0x7e6050bde740> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:rockwellautomation:isagraf_workbench:*:*:*:*:*:*:*:* |