CVE-2012-4701

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-4701
Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging (1) valid credentials or (2) the guest feature.

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf Broken Link Third Party Advisory US Government Resource
https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 Broken Link
http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf Broken Link Third Party Advisory US Government Resource
https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:tridium:niagara_ax:3.5:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_ax:3.6:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_ax:3.7:*:*:*:*:*:*:*
History

21 Nov 2024, 01:43

Type Values Removed Values Added
References () http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf - Broken Link, Third Party Advisory, US Government Resource () http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf - Broken Link, Third Party Advisory, US Government Resource
References () https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 - Broken Link () https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 - Broken Link

22 Mar 2023, 14:11

Type Values Removed Values Added
CPE cpe:2.3:a:tridium:niagra_ax_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagra_ax_framework:3.6:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagra_ax_framework:3.7:*:*:*:*:*:*:*		 cpe:2.3:a:tridium:niagara_ax:3.7:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_ax:3.5:*:*:*:*:*:*:*
cpe:2.3:a:tridium:niagara_ax:3.6:*:*:*:*:*:*:*
References (CONFIRM) https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 - (CONFIRM) https://www.niagara-central.com/ord?portal:/dev/wiki/Niagara_AX_Security_Patch_11-Feb-2013 - Broken Link
References (MISC) http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf - US Government Resource (MISC) http://ics-cert.us-cert.gov/pdf/ICSA-13-045-01.pdf - Broken Link, Third Party Advisory, US Government Resource
Information

Published : 2013-02-15 12:09

Updated : 2025-04-11 00:51

NVD link : CVE-2012-4701

Mitre link : CVE-2012-4701

CVE.ORG link : CVE-2012-4701

JSON object : View

Products Affected

tridium

  • niagara_ax
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')