CVE-2023-4152 - Vulnerability Details - OpenCVE

Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS101 device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Frauscher	Frauscher Diagnostic System 101

Configuration 1 [-]

OR	cpe:2.3:a:frauscher:frauscher_diagnostic_system_101::::::fadc::*
	cpe:2.3:a:frauscher:frauscher_diagnostic_system_101::::::fadci::*

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2023-038/

History

Tue, 24 Sep 2024 17:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:frauscher:frauscher_diagnostic_system_101:-:::::fadc:: cpe:2.3:a:frauscher:frauscher_diagnostic_system_101:-:::::fadci::
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-09-21T06:18:21.444Z

Updated: 2024-09-24T16:21:57.187Z

Reserved: 2023-08-04T09:57:19.862Z

Link: CVE-2023-4152

Vulnrichment

Updated: 2024-08-02T07:17:11.935Z

NVD

Status : Modified

Published: 2023-09-21T07:15:14.300

Modified: 2024-11-21T08:34:29.573

Link: CVE-2023-4152

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4152", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-08-04T09:57:19.862Z", "datePublished": "2023-09-21T06:18:21.444Z", "dateUpdated": "2024-09-24T16:21:57.187Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "FDS101 for FAdC/FAdCi", "vendor": "Frauscher", "versions": [{"lessThanOrEqual": "1.4.24", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2023-09-21T06:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS101 device.</span><br>"}], "value": "Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS101 device.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-09-21T06:18:21.444Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-038/"}], "source": {"discovery": "UNKNOWN"}, "title": "Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:17:11.935Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-038/", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "frauscher", "product": "frauscher_diagnostic_system_101", "cpes": ["cpe:2.3:a:frauscher:frauscher_diagnostic_system_101:-:*:*:*:*:fadc:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.24", "versionType": "custom"}]}, {"vendor": "frauscher", "product": "frauscher_diagnostic_system_101", "cpes": ["cpe:2.3:a:frauscher:frauscher_diagnostic_system_101:-:*:*:*:*:fadci:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.24", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T16:19:46.131129Z", "id": "CVE-2023-4152", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T16:21:57.187Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4152", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-08-04T09:57:19.862Z", "datePublished": "2023-09-21T06:18:21.444Z", "dateUpdated": "2024-09-24T16:21:57.187Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "FDS101 for FAdC/FAdCi", "vendor": "Frauscher", "versions": [{"lessThanOrEqual": "1.4.24", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2023-09-21T06:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS101 device.</span><br>"}], "value": "Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS101 device.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-09-21T06:18:21.444Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-038/"}], "source": {"discovery": "UNKNOWN"}, "title": "Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:17:11.935Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2023-038/", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4152", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-24T16:19:46.131129Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:frauscher:frauscher_diagnostic_system_101:-:*:*:*:*:fadc:*:*"], "vendor": "frauscher", "product": "frauscher_diagnostic_system_101", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.4.24"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:frauscher:frauscher_diagnostic_system_101:-:*:*:*:*:fadci:*:*"], "vendor": "frauscher", "product": "frauscher_diagnostic_system_101", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.4.24"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T16:21:49.050Z"}}]}}