CVE-2022-26067 Path traversal in OAS Platform
An attacker can read arbitrary files from the server by sending specially crafted network requests to the OAS Platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-26067?
CVE-2022-26067 is a medium-severity path traversal vulnerability in Open Automation Software OAS Platform, published on 25 May 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this vulnerability.
Weakness: CWE-306
Which versions are affected by CVE-2022-26067?
It affects 1 product.
Products include Openautomationsoftware Oas Platform.
How do I fix CVE-2022-26067?
No fix has been published for CVE-2022-26067 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-26067 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-26067 exists.
Other vulnerabilities in Open Automation Software OAS Platform
Sources
Also known as GHSA-77wc-m5p2-7cfw.