CVEvulnerability
CVE-2014-0751
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-01-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
The CIMPLICITY Web-based access component, CimWebServer, does not check
the location of shell files being loaded into the system. By modifying
the source location, an attacker could send shell code to the
CimWebServer which would deploy the nefarious files as part of any SCADA
project. This could allow the attacker to execute arbitrary code.
Affected configurations
• ge intelligent platforms proficy hmi\%2fscada cimplicity (<= 8.2)
• ge intelligent platforms proficy hmi\/scada cimplicity 4.01
• ge intelligent platforms proficy hmi\/scada cimplicity 7.5
• ge intelligent platforms proficy hmi\/scada cimplicity 8.0
• ge intelligent platforms proficy hmi\/scada cimplicity 8.1
• ge intelligent platforms proficy hmi\/scada cimplicity 8.2
• ge intelligent platforms proficy process systems with cimplicity
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 support.ge-ip.com
- http://www.securityfocus.com/bid/65124 www.securityfocus.com
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01 www.cisa.gov
- http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 ics-cert.us-cert.gov
- http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940 Vendor Advisory
- http://www.securityfocus.com/bid/65117 www.securityfocus.com