CVE-2022-43514
CVSS V2 None
CVSS V3 None
Description
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4). The affected component does not correctly validate the root path on folder related operations, allowing to modify files and folders outside the intended root directory. This could allow an unauthenticated remote attacker to execute file operations of files outside of the specified root folder. Chained with CVE-2022-43513 this could allow Remote Code Execution.
Overview
- CVE ID
- CVE-2022-43514
- Assigner
- productcert@siemens.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-01-10T12:15:23
- Last Modified Date
- 2023-01-14T00:47:39
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:siemens:automation_license_manager:5.0.0:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:5.1:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:5.1:sp1:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:5.2:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:5.3:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:5.3:sp3:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:5.3.4.4:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:6.0:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:6.0.1:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:6.0.8:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:siemens:automation_license_manager:6.0.9:*:*:*:*:*:*:* | 1 | OR |
References
Reference URL | Reference Tags |
---|---|
https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-43514 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43514 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2023-01-10 12:20:29 | Added to TrackCVE | |||
2023-01-10 12:20:29 | Weakness Enumeration | new | ||
2023-01-10 14:18:54 | 2023-01-10T13:36:03 | CVE Modified Date | updated | |
2023-01-10 14:18:54 | Received | Awaiting Analysis | Vulnerability Status | updated |
2023-01-13 11:15:14 | Awaiting Analysis | Undergoing Analysis | Vulnerability Status | updated |
2023-01-14 04:15:02 | 2023-01-14T00:47:39 | CVE Modified Date | updated | |
2023-01-14 04:15:02 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |
2023-01-14 04:15:03 | CPE Information | updated |