CVE-2014-0751CWE-22

GE Proficy HMI/SCADA Path Traversal

Medium · published January 25, 2014

CVSS v2.0
6.8
EPSS
3%
Percentile
87.5
In the wild
Unconfirmed
What it is

The CIMPLICITY Web-based access component, CimWebServer, does not check

the location of shell files being loaded into the system. By modifying

the source location, an attacker could send shell code to the

CimWebServer which would deploy the nefarious files as part of any SCADA

project. This could allow the attacker to execute arbitrary code.

The record
Technical detail
CVSS v2.0
6.8 · MEDIUM
Vector
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v4.0
Not supplied
EPSS
0.03075 · 87.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2014-01-25T22:00Z
EPSS history
Timeline
  • 25 JAN 22:00Z
    GE Proficy HMI/SCADA Path Traversal
    cvelistv5