cve-2023-3670
Vulnerability from cvelistv5
Published
2023-07-28 07:52
Modified
2024-10-21 17:43
Severity ?
EPSS score ?
Summary
Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting
References
▼ | URL | Tags | |
---|---|---|---|
info@cert.vde.com | https://cert.vde.com/en/advisories/VDE-2023-024 | Third Party Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
CODESYS | CODESYS Development System | |
CODESYS | CODESYS Scripting |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:01:57.057Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://cert.vde.com/en/advisories/VDE-2023-024" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-3670", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-21T17:43:39.441777Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-21T17:43:52.386Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "CODESYS Development System", "vendor": "CODESYS", "versions": [ { "lessThan": "3.5.17.0", "status": "affected", "version": "3.5.9.0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "CODESYS Scripting", "vendor": "CODESYS", "versions": [ { "lessThan": "4.1.0.0", "status": "affected", "version": "4.0.0.0", "versionType": "semver" } ] } ], "datePublic": "2023-07-28T07:45:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In CODESYS Development System 3.5.9.0 to\u0026nbsp;3.5.17.0 and\u0026nbsp;CODESYS Scripting\u0026nbsp;4.0.0.0 to\u0026nbsp;4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users." } ], "value": "In CODESYS Development System 3.5.9.0 to\u00a03.5.17.0 and\u00a0CODESYS Scripting\u00a04.0.0.0 to\u00a04.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-668", "description": "CWE-668 Exposure of Resource to Wrong Sphere", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-07-28T07:52:33.639Z", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE" }, "references": [ { "url": "https://cert.vde.com/en/advisories/VDE-2023-024" } ], "source": { "advisory": "VDE-2023-024", "defect": [ "CERT@VDE#64563" ], "discovery": "UNKNOWN" }, "title": "Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2023-3670", "datePublished": "2023-07-28T07:52:33.639Z", "dateReserved": "2023-07-14T07:43:16.307Z", "dateUpdated": "2024-10-21T17:43:52.386Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-3670\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2023-07-28T08:15:10.557\",\"lastModified\":\"2023-08-03T18:44:39.050\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In CODESYS Development System 3.5.9.0 to\u00a03.5.17.0 and\u00a0CODESYS Scripting\u00a04.0.0.0 to\u00a04.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.9.0\",\"versionEndExcluding\":\"3.5.17.0\",\"matchCriteriaId\":\"727C53CA-E8D1-4280-8CFA-64A6ECFDA41B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:codesys:scripting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0.0\",\"versionEndExcluding\":\"4.1.0.0\",\"matchCriteriaId\":\"FBD63247-C6C1-44FC-99C7-71FC875125A6\"}]}]}],\"references\":[{\"url\":\"https://cert.vde.com/en/advisories/VDE-2023-024\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.