CVE-2025-0659
Path Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private Cloud
- State
- Published
- Severity
- 7.0 High
- Published
- Jan 28, 2025
- Updated
- Jan 28, 2025
- Reserved
- Jan 22, 2025
Description
A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character sequence in the body of the vulnerable endpoint, it is possible to overwrite files outside of the intended directory. A threat actor with admin privileges could leverage this vulnerability to overwrite reports including user projects.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | Rockwell |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
DataEdgePlatform DataMosaix™ Private CloudRockwell Automation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.