Sign-up

ID

VAR-201305-0006


CVE

CVE-2011-4518


TITLE

MICROSYS PROMOTIC Directory Traversal Vulnerability

Trust: 0.8

sources: IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-06169

DESCRIPTION

Directory traversal vulnerability in the PmWebDir object in the web server in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to read arbitrary files via unspecified vectors. PROMOTIC is a SCADA software. A directory traversal vulnerability exists in MICROSYS PROMOTIC. PROMOTIC is prone to multiple security vulnerabilities. Exploiting these issues may allow remote attackers to execute arbitrary code within the context of the affected application or disclose sensitive information. PROMOTIC 8.1.3 is vulnerable; other versions may also be affected

Trust: 2.61

sources: NVD: CVE-2011-4518 // JVNDB: JVNDB-2011-005230 // CNVD: CNVD-2013-06169 // BID: 50133 // IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-06169

AFFECTED PRODUCTS

vendor:microsysmodel:promoticscope:eqversion:8.0.5

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.0.9

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.0.6

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.0.7

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.1.0

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.1.3

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.1.2

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.1.1

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.0.8

Trust: 1.6

vendor:microsysmodel:promoticscope:eqversion:8.0.1

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.2

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.11

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.0

Trust: 1.0

vendor:microsysmodel:promoticscope:lteversion:8.1.4

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.10

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.4

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.12

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.13

Trust: 1.0

vendor:microsysmodel:promoticscope:eqversion:8.0.3

Trust: 1.0

vendor:microsysmodel:promoticscope:ltversion:8.1.5

Trust: 0.8

vendor:microsysmodel:spol. s r.o. promoticscope:eqversion:8.1.4

Trust: 0.6

vendor:microsysmodel:spol. s r.o. promoticscope:eqversion:8.1.3

Trust: 0.6

vendor:microsysmodel:promoticscope:eqversion:8.1.4

Trust: 0.6

vendor:promoticmodel:promoticscope:eqversion:8.1.3

Trust: 0.3

vendor:promoticmodel: - scope:eqversion:8.0.0

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.1

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.2

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.3

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.4

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.5

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.6

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.7

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.8

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.9

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.10

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.11

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.12

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.0.13

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.1.0

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.1.1

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.1.2

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:8.1.3

Trust: 0.2

vendor:promoticmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-06169 // BID: 50133 // JVNDB: JVNDB-2011-005230 // NVD: CVE-2011-4518 // CNNVD: CNNVD-201205-482

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2011-4518
value: MEDIUM

Trust: 1.8

CNVD: CNVD-2013-06169
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201205-482
value: MEDIUM

Trust: 0.6

IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

NVD:
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2011-4518
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2013-06169
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-06169 // JVNDB: JVNDB-2011-005230 // NVD: CVE-2011-4518 // CNNVD: CNNVD-201205-482

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.8

sources: JVNDB: JVNDB-2011-005230 // NVD: CVE-2011-4518

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201205-482

TYPE

Path traversal

Trust: 0.8

sources: IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201205-482

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2011-4518

PATCH
title:Version 8.1.5 (from 28.11.2011) - stable versionurl:http://www.promotic.eu/en/pmdoc/news.htm#ver80105
Trust: 0.8
title:MICROSYS PROMOTIC directory traversal vulnerability patchurl:https://www.cnvd.org.cn/patchinfo/show/34283
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-06169 // 
            
            
            
            JVNDB: JVNDB-2011-005230

EXTERNAL IDS
db:NVDid:CVE-2011-4518
Trust: 3.2
db:ICS CERTid:ICSA-12-024-02
Trust: 2.7
db:BIDid:50133
Trust: 1.5
db:CNVDid:CNVD-2013-06169
Trust: 0.8
db:CNNVDid:CNNVD-201205-482
Trust: 0.8
db:JVNDBid:JVNDB-2011-005230
Trust: 0.8
db:IVDid:EF3A1F72-2352-11E6-ABEF-000C29C66E3D
Trust: 0.2
sources:
            
            
            IVD: ef3a1f72-2352-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2013-06169 // 
            
            
            
            BID: 50133 // 
            
            
            
            JVNDB: JVNDB-2011-005230 // 
            
            
            
            NVD: CVE-2011-4518 // 
            
            
            
            CNNVD: CNNVD-201205-482

REFERENCES
url:http://www.promotic.eu/en/pmdoc/news.htm#ver80105
Trust: 2.5
url:http://ics-cert.us-cert.gov/advisories/icsa-12-024-02
Trust: 2.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4518
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4518
Trust: 0.8
url:http://www.securityfocus.com/bid/50133
Trust: 0.6
url:http://www.promotic.eu/en/promotic/scada-pm.htm
Trust: 0.3
url:http://aluigi.altervista.org/adv/promotic_1-adv.txt
Trust: 0.3
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-024-02.pdf
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2013-06169 // 
            
            
            
            BID: 50133 // 
            
            
            
            JVNDB: JVNDB-2011-005230 // 
            
            
            
            NVD: CVE-2011-4518 // 
            
            
            
            CNNVD: CNNVD-201205-482

CREDITS
Luigi Auriemma
Trust: 0.9
sources:
            
            
            BID: 50133 // 
            
            
            
            CNNVD: CNNVD-201205-482

SOURCES
db:IVDid:ef3a1f72-2352-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-06169
db:BIDid:50133
db:JVNDBid:JVNDB-2011-005230
db:NVDid:CVE-2011-4518
db:CNNVDid:CNNVD-201205-482

LAST UPDATE DATE
2023-12-18T12:09:22.288000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-06169date:2013-05-28T00:00:00
db:BIDid:50133date:2011-10-14T00:00:00
db:JVNDBid:JVNDB-2011-005230date:2013-05-27T00:00:00
db:NVDid:CVE-2011-4518date:2013-06-03T04:00:00
db:CNNVDid:CNNVD-201205-482date:2013-05-24T00:00:00

SOURCES RELEASE DATE
db:IVDid:ef3a1f72-2352-11e6-abef-000c29c66e3ddate:2013-05-28T00:00:00
db:CNVDid:CNVD-2013-06169date:2013-05-28T00:00:00
db:BIDid:50133date:2011-10-14T00:00:00
db:JVNDBid:JVNDB-2011-005230date:2013-05-27T00:00:00
db:NVDid:CVE-2011-4518date:2013-05-23T17:55:02.807
db:CNNVDid:CNNVD-201205-482date:1900-01-01T00:00:00