CVE-2020-12003

Katalog CVE

CVSS 7.5 · High EPSS 5,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada rockwellautomation factorytalk linx, rockwellautomation rslinx classic. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to use specially crafted requests to traverse the file system and expose sensitive data on the local hard drive.

Rincian

Terbit di NVD

15 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

5,2% peluang dieksploitasi; lebih tinggi dari 92,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.us-cert.gov/ics/advisories/icsa-20-163-02 advisory pihak ketiga · pemerintah AS