High severity · published Dec 23, 2022
CVE-2022-23854
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on…
7.5
CVSS
49.7%
EPSS
No
On KEV
Description
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)49.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
Intouch Access Anywhere · Aveva
before 2020; 2020; 2020 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23854
crisec.de
https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
www.aveva.com
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-001_r.pdf
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
More from Intouch Access Anywhere
9.9
CVE-2022-1467
Windows OS can be configured to overlay a “language bar” on top of any application