CVE-2021-22804

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-22804
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to missing validation of user supplied data in network messages. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:schneider-electric:interactive_graphical_scada_system_data_collector:*:*:*:*:*:*:*:*
History

No history.

Information

Published : 2022-02-11 18:15

Updated : 2022-02-18 15:16

NVD link : CVE-2021-22804

Mitre link : CVE-2021-22804

CVE.ORG link : CVE-2021-22804

JSON object : View

Products Affected

schneider-electric

  • interactive_graphical_scada_system_data_collector
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')