CVE-2023-1109CWE-22

PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service

High · published April 17, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the service.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-04-17T07:32Z
EPSS history
Timeline
  • 17 APR 07:32Z
    PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service
    cvelistv5