CVE-2022-23854

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

45.96%

Published

Dec 23, 2022

Modified

Feb 13, 2025

Public PoC / Exploit (3)

All weaponized →

Exploit-DBAVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-23CWE-22

Affected Products (3)

aveva · intouch_access_anywhere (up to 2020)vulnerable

aveva · intouch_access_anywherevulnerable

References (6)

https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal

https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-001_r.pdf

https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02

Third Party AdvisoryUS Government Resource

https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal

https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2023-001_r.pdf

https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02

Third Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs