CVE-2023-28382

Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for Solaris V1.1.0 to V1.4.0, ESS REC Agent Server Edition for HP-UX V1.1.0 to V1.4.0, and ESS REC Agent Server Edition for AIX V1.2.0 to V1.4.1

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://customer.et-x.jp/app/answers/detail/a_id/2260	Permissions Required
https://jvn.jp/en/jp/JVN19243534/	Third Party Advisory
https://customer.et-x.jp/app/answers/detail/a_id/2260	Permissions Required
https://jvn.jp/en/jp/JVN19243534/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:et-x:ess_rec:::::server:linux::
	cpe:2.3:a:et-x:ess_rec:::::server:hp-ux::
	cpe:2.3:a:et-x:ess_rec:::::server:solaris::
	cpe:2.3:a:et-x:ess_rec:::::server:aix::

History

No history.

Information

Published : 2023-05-26 09:15

Updated : 2025-01-15 16:15

NVD link : CVE-2023-28382

Mitre link : CVE-2023-28382

CVE.ORG link : CVE-2023-28382

JSON object : View

Products Affected

et-x

ess_rec

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-28382", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-05-26T09:15:38.593", "references": [{"url": "https://customer.et-x.jp/app/answers/detail/a_id/2260", "tags": ["Permissions Required"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN19243534/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://customer.et-x.jp/app/answers/detail/a_id/2260", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://jvn.jp/en/jp/JVN19243534/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for Solaris V1.1.0 to V1.4.0, ESS REC Agent Server Edition for HP-UX V1.1.0 to V1.4.0, and ESS REC Agent Server Edition for AIX V1.2.0 to V1.4.1"}], "lastModified": "2025-01-15T16:15:26.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:et-x:ess_rec:*:*:*:*:server:linux:*:*", "vulnerable": true, "matchCriteriaId": "C0FFF86F-71B6-4E7C-8EE7-AA7B33CD7F11", "versionEndIncluding": "1.4.3", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:et-x:ess_rec:*:*:*:*:server:hp-ux:*:*", "vulnerable": true, "matchCriteriaId": "D611D6B5-C896-46F5-89F5-7A1BBDFD176B", "versionEndIncluding": "1.4.0", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:et-x:ess_rec:*:*:*:*:server:solaris:*:*", "vulnerable": true, "matchCriteriaId": "7308CB3C-F553-4F09-9D22-6BAD620BB761", "versionEndIncluding": "1.4.0", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:et-x:ess_rec:*:*:*:*:server:aix:*:*", "vulnerable": true, "matchCriteriaId": "0D81F231-5015-4267-B138-B4AC364CA76B", "versionEndIncluding": "1.4.1", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}