CVE-2017-6045 Information disclosure in Trihedral VTScada

What is CVE-2017-6045?

CVE-2017-6045 is a high-severity vulnerability in Trihedral VTScada, published on 21 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server application to unauthenticated users. These files may contain sensitive configuration information.

Weakness: CWE-200, CWE-548

Which versions are affected by CVE-2017-6045?

It affects 1 product.

Products include Trihedral Vtscada.

How do I fix CVE-2017-6045?

No fix has been published for CVE-2017-6045 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-6045 being exploited?

There is no known exploitation of CVE-2017-6045 in the wild and no public exploit code.

Other vulnerabilities in Trihedral VTScada

• CVE-2016-4523 Trihedral VTScada (formerly VTS) Denial-of-Service Exploited High 7.5
• CVE-2016-4510 Auth bypass in n/a Critical 9.1
• CVE-2016-4532 Path traversal in n/a Critical 9.1
• CVE-2017-14029 Other in Trihedral Engineering Limited VTScada High 7.8
• CVE-2017-14031 Privilege escalation in Trihedral Engineering Limited VTScada High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c2gj-rqw8-v3hw.