CVE-2023-35020CWE-22

IBM Sterling Control Center directory traversal

Medium · published January 19, 2024

CVSS v3.1

5.4

EPSS

Percentile

44.4

In the wild

Unconfirmed

What it is

IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257874.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00537 · 44.4th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2024-01-19T01:05Z

EPSS history

Timeline

19 JAN 01:05Z
IBM Sterling Control Center directory traversal
cvelistv5