CVE-2022-43513 Path traversal in Automation License Manager V5
Unauthenticated attackers can rename or move files as SYSTEM via path traversal in Siemens Automation License Manager and TeleControl Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-43513?
CVE-2022-43513 is a high-severity path traversal vulnerability in Siemens Automation License Manager V5, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.
Which versions are affected by CVE-2022-43513?
It affects 1 product.
Products include Siemens Automation License Manager.
How do I fix CVE-2022-43513?
No fix has been published for CVE-2022-43513 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-43513 being exploited?
There is no known exploitation of CVE-2022-43513 in the wild and no public exploit code.
Other vulnerabilities in Siemens Automation License Manager V5
- CVE-2016-8565 Missing authorization in n/a
- CVE-2018-11455 Path traversal in Automation License Manager 5, Automation License Manager 6
- CVE-2020-7583 Missing authorization in Automation License Manager 5
- CVE-2022-43514 Path traversal in Automation License Manager V5
- CVE-2021-25659 Denial of service in Automation License Manager 5
Sources
Also known as GHSA-3mf9-jjrh-xqv8.