Riskcovery

CVE-2022-31218

Drive Composer Link Following Local Privilege Escalation Vulnerability

State
Published
Severity
7.8 High
Published
Jun 15, 2022
Updated
Apr 23, 2025
Reserved
May 19, 2022

Read the record on cve.org

Description

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HABB

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

ProductVersions
Drive Composer entryABB
  • 2.0 to before unspecifiedAffected
  • 2.7 and earlierAffected
Drive Composer proABB
  • 2.0 to before unspecifiedAffected
  • 2.7 and earlierAffected
ABB Automation BuilderABB
  • 1.1.0 to before unspecifiedAffected
  • 2.5.0 and earlierAffected
Mint WorkBenchABB
  • build through 5866Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.