cve-2023-0956
Vulnerability from cvelistv5
Published
2023-08-03 18:08
Modified
2024-08-02 05:32
Severity ?
EPSS score ?
Summary
TEL-STER TelWin SCADA WebInterface Path Traversal
References
| ▼ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://cert.pl/posts/2023/07/CVE-2023-0956/ | Third Party Advisory | |
| ics-cert@hq.dhs.gov | https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03 | Third Party Advisory, US Government Resource | |
| ics-cert@hq.dhs.gov | https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956 | Vendor Advisory |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| TEL-STER | TelWin SCADA WebInterface |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:32:46.264Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert.pl/posts/2023/07/CVE-2023-0956/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TelWin SCADA WebInterface",
"vendor": "TEL-STER",
"versions": [
{
"lessThanOrEqual": "6.1",
"status": "affected",
"version": "3.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.1",
"status": "affected",
"version": "7.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Marcin Dudek of CERT.PL reported this vulnerability to TEL-STER."
}
],
"datePublic": "2023-08-03T18:04:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eExternal input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.\u003c/span\u003e\n\n"
}
],
"value": "\nExternal input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "cwe-35 Path Traversal",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-03T18:08:13.924Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03"
},
{
"url": "https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956"
},
{
"url": "https://cert.pl/posts/2023/07/CVE-2023-0956/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eTEL-STER recommends that users \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.tel-ster.pl/index.php/en/telwin-scada-eng/news-telwin-eng\"\u003eupdate WebInterface module\u003c/a\u003e\u0026nbsp;to one of the following versions: 6.2, 7.2, 8.1, 9.1, or 10.0. Please note that the WebInterface is part of the TelWin SCADA software and is usually updated with the software. TEL-STER only currently supports and updates TelWin SCADA 7.8 (WebInteraface 6.x) upwards TEL-STER does not have any updates planned for versions using older vulnerable WebInterface (lower than 6.0), and users are recommended to update TelWin SCADA to one of the supported versions. For more information, please contact TEL-STER.\u003c/p\u003e\u003cp\u003eMore information about this issue and the associated mitigation can be found at \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956\"\u003eTEL-STER advisory\u003c/a\u003e\u0026nbsp;or \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://cert.pl/posts/2023/07/CVE-2023-0956/\"\u003eCERT.PL advisory\u003c/a\u003e.\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nTEL-STER recommends that users update WebInterface module https://www.tel-ster.pl/index.php/en/telwin-scada-eng/news-telwin-eng \u00a0to one of the following versions: 6.2, 7.2, 8.1, 9.1, or 10.0. Please note that the WebInterface is part of the TelWin SCADA software and is usually updated with the software. TEL-STER only currently supports and updates TelWin SCADA 7.8 (WebInteraface 6.x) upwards TEL-STER does not have any updates planned for versions using older vulnerable WebInterface (lower than 6.0), and users are recommended to update TelWin SCADA to one of the supported versions. For more information, please contact TEL-STER.\n\nMore information about this issue and the associated mitigation can be found at TEL-STER advisory https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956 \u00a0or CERT.PL advisory https://cert.pl/posts/2023/07/CVE-2023-0956/ .\n\n\n\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TEL-STER TelWin SCADA WebInterface Path Traversal",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-0956",
"datePublished": "2023-08-03T18:08:13.924Z",
"dateReserved": "2023-02-22T16:00:49.434Z",
"dateUpdated": "2024-08-02T05:32:46.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-0956\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2023-08-03T19:15:10.323\",\"lastModified\":\"2023-08-08T20:10:03.717\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\nExternal input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.\\n\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tel-ster:telwin_scada_webinterface:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"BA0C69E3-ACEB-4DED-B6CD-6EDFCE6FEA9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tel-ster:telwin_scada_webinterface:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.2\",\"matchCriteriaId\":\"5662B55B-7264-48DE-978D-C48A802663A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tel-ster:telwin_scada_webinterface:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2DFACE5-7AB7-44EC-8384-9EB9B9A95A08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tel-ster:telwin_scada_webinterface:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41E91A9D-DDA1-45E4-9FED-2F125DFB5B7A\"}]}]}],\"references\":[{\"url\":\"https://cert.pl/posts/2023/07/CVE-2023-0956/\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-03\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.tel-ster.pl/index.php/telwin-scada/nowosci/372-telwin-scada-podatnosc-cve-2023-0956\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.