github - ghsa-pxfv-24mx-mrvc

ghsa-pxfv-24mx-mrvc

Vulnerability from github

Published

2023-10-17 09:30

Modified

2024-04-04 08:42

Severity ?

2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Details

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-4089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-17T07:15:10Z",
    "severity": "LOW"
  },
  "details": "On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.",
  "id": "GHSA-pxfv-24mx-mrvc",
  "modified": "2024-04-04T08:42:44Z",
  "published": "2023-10-17T09:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4089"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-046"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2023-4089

Vulnerability from cvelistv5

Published

2023-10-17 06:00

Modified

2024-08-02 07:17

Severity ?

2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Summary

WAGO: Multiple products vulnerable to local file inclusion

References

▼	URL	Tags
	https://cert.vde.com/en/advisories/VDE-2023-046/

Impacted products

▼	Vendor	Product
	WAGO	Compact Controller CC100
	WAGO	Edge Controller
	WAGO	PFC100
	WAGO	PFC200
	WAGO	Touch Panel 600 Advanced Line
	WAGO	Touch Panel 600 Marine Line
	WAGO	Touch Panel 600 Standard Line

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:17:11.728Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en/advisories/VDE-2023-046/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compact Controller CC100",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW19",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edge Controller",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW18",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Advanced Line",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Marine Line",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Touch Panel 600 Standard Line",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThanOrEqual": "FW26",
              "status": "affected",
              "version": "FW16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Floris Hendriks and Jeroen Wijenbergh from Radboud University"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected."
            }
          ],
          "value": "On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-610",
              "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-17T06:00:28.908Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2023-046/"
        }
      ],
      "source": {
        "advisory": "VDE-2023-046",
        "defect": [
          "CERT@VDE#64532"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "WAGO: Multiple products vulnerable to local file inclusion",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2023-4089",
    "datePublished": "2023-10-17T06:00:28.908Z",
    "dateReserved": "2023-08-02T07:20:35.600Z",
    "dateUpdated": "2024-08-02T07:17:11.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted