Medium severity · published Jan 17, 2023
CVE-2022-2893
RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
RONDS EPM version 1.19.5 does not properly validate the filename
parameter, which could allow an unauthorized user to specify file paths
and download files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Equipment Predictive Maintenance · Ronds
1.19.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2893
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02
More from Equipment Predictive Maintenance
7.5
CVE-2022-3091
RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials