Vulnerability Details : CVE-2022-43513

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4). The affected components allow to rename license files with user chosen input without authentication. This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.

Vulnerability category: File inclusion

Published 2023-01-10 12:15:23

Updated 2023-01-13 20:35:30

Source Siemens AG

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-43513

Probability of exploitation activity in the next 30 days: 0.08%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 33 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-43513

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L	3.9	4.2	productcert@siemens.com
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: Low

CWE ids for CVE-2022-43513

CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

Assigned by: productcert@siemens.com (Secondary)
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-43513

https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf

Vendor Advisory

CVEs referencing this url

Products affected by CVE-2022-43513

Siemens » Automation License Manager » Version: 5.1
cpe:2.3:a:siemens:automation_license_manager:5.1:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 5.1 Update SP1
cpe:2.3:a:siemens:automation_license_manager:5.1:sp1:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 6.0
cpe:2.3:a:siemens:automation_license_manager:6.0:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 6.0.1
cpe:2.3:a:siemens:automation_license_manager:6.0.1:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 6.0.8
cpe:2.3:a:siemens:automation_license_manager:6.0.8:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 6.0.9
cpe:2.3:a:siemens:automation_license_manager:6.0.9:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 5.0.0
cpe:2.3:a:siemens:automation_license_manager:5.0.0:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 5.2
cpe:2.3:a:siemens:automation_license_manager:5.2:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 5.3
cpe:2.3:a:siemens:automation_license_manager:5.3:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 5.3.4.4
cpe:2.3:a:siemens:automation_license_manager:5.3.4.4:*:*:*:*:*:*:*
Matching versions
Siemens » Automation License Manager » Version: 5.3 Update SP3
cpe:2.3:a:siemens:automation_license_manager:5.3:sp3:*:*:*:*:*:*
Matching versions