CVE-2024-37365CWE-20

FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path

High · published November 12, 2024

CVSS v4.0
7.0
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

A remote code execution vulnerability exists in the affected

product. The vulnerability allows users to save projects within the public

directory allowing anyone with local access to modify and/or delete files. Additionally,

a malicious user could potentially leverage this vulnerability to escalate

their privileges by changing the macro to execute arbitrary code.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00225 · 12.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-11-12T14:52Z
EPSS history
Timeline
  • 12 NOV 14:52Z
    FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path
    cvelistv5