Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.
References
Link | Resource |
---|---|
https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01 | Third Party Advisory US Government Resource |
https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:18
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01 - Third Party Advisory, US Government Resource | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
Information
Published : 2022-11-17 22:15
Updated : 2024-11-21 07:18
NVD link : CVE-2022-3090
Mitre link : CVE-2022-3090
CVE.ORG link : CVE-2022-3090
JSON object : View
Products Affected
redlion
- crimson
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')