CVE-2018-19003

Published: Dec 14, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails to restrict the ability of an attacker to gain access to restricted information.

Affected (5)

Products: Ge: Ex2100e Firmware, Ls2100e Firmware, Mark Vle Firmware

3 products

Ex2100e Firmware

Ls2100e Firmware

Mark Vle Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Ex2100e Firmware	Before 04.09.00c

Running on/with	Platform Versions
Ge Ex2100e	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Ge Ls2100e Firmware	Before 04.09.00c

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Ex2100e Firmware	From 03.03.28c to 05.02.04c

Running on/with	Platform Versions
Ge Ex2100e	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Ls2100e Firmware	From 03.03.28c to 05.02.04c

Running on/with	Platform Versions
Ge Ls2100e	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Mark Vle Firmware	From 03.03.28c to 05.02.04c

Running on/with	Platform Versions
Ge Mark Vle	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

http://www.securityfocus.com/bid/106216

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-18-347-04

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/106216

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-18-347-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.