jvndb-2022-001923
Vulnerability from jvndb
Published
2022-05-27 15:28
Modified
2024-06-20 11:34
Severity ?
Summary
Multiple vulnerabilities in CONTEC SolarView Compact
Details
SolarView Compact provided by CONTEC CO., LTD. is PV Measurement System. SolarView Compact contains multiple vulnerabilities listed below.
OS command injection (CWE-78) - CVE-2022-29303
Improper validation of input values on the send test mail console of the product's web server may result in OS command injection.
Directory traversal (CWE-23) - CVE-2022-29298
Improper validation of a URL on the download page of the product's web server may allow a remote attacker to view and obtain an arbitrary file.
Information disclosure (CWE-200) - CVE-2022-29302
The hidden page which enables to edit the product's web server contents exists in the product's web server, and a remote attacker to read and/or alter an arbitrary file on the web server via the hidden page.
OS command injection (CWE-78) - CVE-2022-40881
Improper validation of input values on Check Network Communication Page of the product's web server may result in an arbitrary OS command execution.
OS command injection (CWE-78) - CVE-2023-23333
Improper validation of input values on the download page of the product's web server may result in an arbitrary OS command execution.
CVE-2022-29298
Jongheon Yan of S2W Inc reported CONTEC CO., LTD. that the fix for the vulnerability was insufficient in Ver.6.5. CONTEC CO., LTD. and JPCERT/CC updated respective advisories.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | https://jvn.jp/en/vu/JVNVU92327282/index.html | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-29303 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-29298 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-29302 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-40881 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2023-23333 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-29303 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-29298 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-29302 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-40881 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2023-23333 | |
| CISA Known Exploited Vulnerabilities Catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | |
| OS Command Injection(CWE-78) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
| Relative Path Traversal(CWE-23) | https://cwe.mitre.org/data/definitions/23.html | |
| Information Exposure(CWE-200) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-001923.html",
"dc:date": "2024-06-20T11:34+09:00",
"dcterms:issued": "2022-05-27T15:28+09:00",
"dcterms:modified": "2024-06-20T11:34+09:00",
"description": "SolarView Compact provided by CONTEC CO., LTD. is PV Measurement System. SolarView Compact contains multiple vulnerabilities listed below.\r\n\r\nOS command injection (CWE-78) - CVE-2022-29303\r\nImproper validation of input values on the send test mail console of the product\u0027s web server may result in OS command injection.\r\n\r\nDirectory traversal (CWE-23) - CVE-2022-29298\r\nImproper validation of a URL on the download page of the product\u0027s web server may allow a remote attacker to view and obtain an arbitrary file.\r\n\r\nInformation disclosure (CWE-200) - CVE-2022-29302\r\nThe hidden page which enables to edit the product\u0027s web server contents exists in the product\u0027s web server, and a remote attacker to read and/or alter an arbitrary file on the web server via the hidden page.\r\n\r\nOS command injection (CWE-78) - CVE-2022-40881\r\nImproper validation of input values on Check Network Communication Page of the product\u0027s web server may result in an arbitrary OS command execution.\r\n\r\nOS command injection (CWE-78) - CVE-2023-23333\r\nImproper validation of input values on the download page of the product\u0027s web server may result in an arbitrary OS command execution.\r\n\r\nCVE-2022-29298\r\nJongheon Yan of S2W Inc reported CONTEC CO., LTD. that the fix for the vulnerability was insufficient in Ver.6.5. CONTEC CO., LTD. and JPCERT/CC updated respective advisories.",
"link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-001923.html",
"sec:cpe": [
{
"#text": "cpe:/o:contec:sv-cpt-mc310f_firmware",
"@product": "SolarView Compact SV-CPT-MC310F",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/o:contec:sv-cpt-mc310f_firmware",
"@product": "SolarView Compact SV-CPT-MC310F",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/o:contec:sv-cpt-mc310_firmware",
"@product": "SolarView Compact SV-CPT-MC310",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/o:contec:sv-cpt-mc310_firmware",
"@product": "SolarView Compact SV-CPT-MC310",
"@vendor": "Contec",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "5.0",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"@version": "2.0"
},
{
"@score": "9.8",
"@severity": "Critical",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2022-001923",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU92327282/index.html",
"@id": "JVNVU#92327282",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-29303",
"@id": "CVE-2022-29303",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-29298",
"@id": "CVE-2022-29298",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-29302",
"@id": "CVE-2022-29302",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-40881",
"@id": "CVE-2022-40881",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-23333",
"@id": "CVE-2023-23333",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-29303",
"@id": "CVE-2022-29303",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-29298",
"@id": "CVE-2022-29298",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-29302",
"@id": "CVE-2022-29302",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-40881",
"@id": "CVE-2022-40881",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-23333",
"@id": "CVE-2023-23333",
"@source": "NVD"
},
{
"#text": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"@id": "CVE-2022-29303",
"@source": "CISA Known Exploited Vulnerabilities Catalog"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/23.html",
"@id": "CWE-23",
"@title": "Relative Path Traversal(CWE-23)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-200",
"@title": "Information Exposure(CWE-200)"
}
],
"title": "Multiple vulnerabilities in CONTEC SolarView Compact"
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.