CVE-2022-34836: abb abb zenon Relative Path Traversal

Vulnerability summary

CVE-2022-34836 is a high (CVSS 8.2) Relative Path Traversal vulnerability in abb abb zenon. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.6% of scored vulnerabilities.

Timeline

1. 24-08-2022
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon runtime activities such as the start and stop of various activity and the last error code etc.

• CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.