high7.5
CVE-2019-13532
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files out…
Impact
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Codesys | Control For Beaglebone | before 3.5.14.10 |
| Codesys | Control For Empc-A\/Imx6 | before 3.5.14.10 |
| Codesys | Control For Iot2000 | before 3.5.14.10 |
| Codesys | Control For Linux | before 3.5.14.10 |
| Codesys | Control For Pfc100 | before 3.5.14.10 |
| Codesys | Control For Pfc200 | before 3.5.14.10 |
| Codesys | Control For Raspberry Pi | before 3.5.14.10 |
| Codesys | Control Rte | from 3.5.8.60 before 3.5.12.80 from 3.5.13.0 before 3.5.14.10 |
| Codesys | Control Runtime System Toolkit | from 3.0 before 3.5.12.80 |
| Codesys | Control Win | from 3.5.9.80 through 3.5.12.80 from 3.5.13.0 before 3.5.14.10 |
| Codesys | Embedded Target Visu Toolkit | from 3.0 before 3.5.12.80 |
| Codesys | Hmi | from 3.5.10.0 before 3.5.12.80 from 3.5.13.0 before 3.5.14.10 |