← Back

CVE-2022-31218

nvd nist
Published: Jun 15, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.

Affected (4)

Abb
3 products
Automation Builder
Drive Composer
Mint Workbench
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Automation Builder
From 1.1.0 to 2.5.0
Abb
Drive Composer
From 2.0 to 2.7.1
Drive Composer
From 2.0 to 2.7.1
Mint Workbench
Up to 5866

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (2)

Source: cybersecurity@ch.abb.com
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory

Timeline

No history available yet.