CVE-2012-4701

Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging (1) valid credentials or (2) the guest feature.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf	Broken Link Third Party Advisory US Government Resource
https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013	Broken Link
http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf	Broken Link Third Party Advisory US Government Resource
https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tridium:niagara_ax:3.5:::::::*
	cpe:2.3:a:tridium:niagara_ax:3.6:::::::*
	cpe:2.3:a:tridium:niagara_ax:3.7:::::::*

History

21 Nov 2024, 01:43

Type	Values Removed	Values Added
References	~~() http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf - Broken Link, Third Party Advisory, US Government Resource~~	() http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf - Broken Link, Third Party Advisory, US Government Resource
References	~~() https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 - Broken Link~~	() https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 - Broken Link

Information

Published : 2013-02-15 12:09

Updated : 2024-11-21 01:43

NVD link : CVE-2012-4701

Mitre link : CVE-2012-4701

CVE.ORG link : CVE-2012-4701

JSON object : View

Products Affected

tridium

niagara_ax

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2012-4701", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-02-15T12:09:27.773", "references": [{"url": "http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf", "tags": ["Broken Link", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013", "tags": ["Broken Link"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf", "tags": ["Broken Link", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging (1) valid credentials or (2) the guest feature."}, {"lang": "es", "value": "Vulnerabilidad de directorio trasversal en Tridium Niagara AX v3.5, v3.6, y v3.7 que permite ataques remotos para la lectura de ficheros y ejecutar c\u00f3digo haciendo uso de la validaci\u00f3n de credenciales."}], "lastModified": "2024-11-21T01:43:22.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tridium:niagara_ax:3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F2BEB15-BFB9-4936-A5CB-F1E2B35D2482"}, {"criteria": "cpe:2.3:a:tridium:niagara_ax:3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B21BACBE-5117-49FB-8BCF-8499716C345C"}, {"criteria": "cpe:2.3:a:tridium:niagara_ax:3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A9B9834-10D8-47A7-981A-1947342C1E81"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}