Stored Absolute Path Traversal in ASPECT, NEXUS, and MATRIX by ABB
CVE-2024-13945
8.4HIGH
What is CVE-2024-13945?
The stored absolute path traversal vulnerability in ABB's ASPECT, NEXUS, and MATRIX products opens a potential attack vector that may lead to unauthorized exposure of sensitive information if administrator credentials are compromised. This can occur during data processing, allowing an attacker to access files outside of the intended directory structure, thereby risking data integrity and confidentiality. Users are advised to implement stringent access controls and apply necessary patches as soon as they become available to mitigate the risks associated with this vulnerability.
Affected Version(s)
ASPECT-Enterprise Linux 0 <= 3.*
MATRIX Series Linux 0 <= 3.*
NEXUS Series Linux 0 <= 3.*
References
CVSS V4
Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
ABB likes to thank Gjoko Krstikj, Zero Science Lab, for reporting the vulnerabilities in responsible disclosure