CVE-2022-43514
Summary
| CVE | CVE-2022-43514 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-01-10 12:15:00 UTC |
| Updated | 2023-11-07 03:53:00 UTC |
| Description | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4). The affected component does not correctly validate the root path on folder related operations, allowing to modify files and folders outside the intended root directory. This could allow an unauthenticated remote attacker to execute file operations of files outside of the specified root folder. Chained with CVE-2022-43513 this could allow Remote Code Execution. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Siemens | Automation License Manager | 5.0.0 | All | All | All |
| Application | Siemens | Automation License Manager | 5.1 | All | All | All |
| Application | Siemens | Automation License Manager | 5.1 | sp1 | All | All |
| Application | Siemens | Automation License Manager | 5.2 | All | All | All |
| Application | Siemens | Automation License Manager | 5.3 | All | All | All |
| Application | Siemens | Automation License Manager | 5.3 | sp3 | All | All |
| Application | Siemens | Automation License Manager | 5.3.4.4 | All | All | All |
| Application | Siemens | Automation License Manager | 6.0 | All | All | All |
| Application | Siemens | Automation License Manager | 6.0.1 | All | All | All |
| Application | Siemens | Automation License Manager | 6.0.8 | All | All | All |
| Application | Siemens | Automation License Manager | 6.0.9 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf | MISC | cert-portal.siemens.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 591314 Siemens Automation License Manager Multiple Vulnerabilities (ICSA-23-012-10,SSA-476715)