CVE-2023-2917

Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

State: Published
Severity: 9.8 Critical
Published: Aug 17, 2023
Updated: Oct 8, 2024
Reserved: May 26, 2023

Description

The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Rockwell

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
ThinManager ThinServerRockwell Automation	11.0.0 - 11.2.6Affected 11.1.0 - 11.1.6Affected 11.2.0 - 11.2.7Affected 12.0.0 - 12.0.5Affected 12.1.0 - 12.1.6Affected 13.0.0 - 13.0.2Affected 13.1.0Affected

References

https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140471

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.