high7.5Public exploit code
CVE-2022-23854
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network acces…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal2022-11-11 · remote · hardware
Impact
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aveva | Intouch Access Anywhere | before 2020 Version 2020 |
Weakness classification
References
- NVD record
- CVE.org record
- https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-001_r.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
- https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-001_r.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02