Vulnerability CVE-2012-4027

Vulnerability CVE-2012-4027

Published: 2012-07-16 Modified: 2012-07-17

Description:

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.

Type:

CWE-264

(Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5/10	2.9/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	None	None

Affected software
Tridium -> Niagra ax framework

References:

https://www.tridium.com/galleries/briefings/NiagaraAX_Framework_Software_Security_Alert.pdf

http://www.washingtonpost.com/investigations/tridiums-niagara-framework-marvel-of-connectivity-illustrates-new-cyber-risks/2012/07/11/gJQARJL6dW_story.html

Vulnerability CVE-2012-4027

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.

CWE-264

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

5/10

2.9/10

10/10

Remote

Low

No required

Partial

None

None

Affected software

References: