CVE-2023-27856CWE-22
Rockwell Automation ThinManager ThinServer Path Traversal Download
High · published March 21, 2023
Patch now
High probability of exploitation
CVSS calls it high at 7.5. It sits in the 99.6th percentile for exploit probability.
What it is
In affected versions, path traversal exists when processing a message of type 8
in Rockwell Automation's ThinManager ThinServer.
An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.77225 · 99.6th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2023-03-21T23:55Z
EPSS history
Timeline