CVE-2023-3329

Published Aug 2, 2023

Last updated 17 days ago

CVSS medium 6.5

Overview

Description: SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
Source: ics-cert@hq.dhs.gov
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 5.2
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:spidercontrol:scadawebserver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EDC0851-BDA7-4653-8696-BBF08E93D6CB",
            "versionEndIncluding": "2.08"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References