CVE-2012-4705: Path Traversal
Published Feb 24, 2013
·Updated
Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname.
Affected Software
17 affected components
3s-software Codesys Gateway-server<=2.3.9.20
3s-software Codesys Gateway-server=2.3.5.1
3s-software Codesys Gateway-server=2.3.5.2
3s-software Codesys Gateway-server=2.3.5.3
3s-software Codesys Gateway-server=2.3.6.0
3s-software Codesys Gateway-server=2.3.7.0
3s-software Codesys Gateway-server=2.3.8.0
3s-software Codesys Gateway-server=2.3.8.1
3s-software Codesys Gateway-server=2.3.8.2
3s-software Codesys Gateway-server=2.3.9
3s-software Codesys Gateway-server=2.3.9.1
3s-software Codesys Gateway-server=2.3.9.2
3s-software Codesys Gateway-server=2.3.9.3
3s-software Codesys Gateway-server=2.3.9.4
3s-software Codesys Gateway-server=2.3.9.5
3s-software Codesys Gateway-server=2.3.9.18
3s-software Codesys Gateway-server=2.3.9.19
Event History
Feb 24, 2013
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4705?
CVE-2012-4705 is considered a critical vulnerability as it allows remote attackers to execute arbitrary code.
2
How do I fix CVE-2012-4705?
To fix CVE-2012-4705, update the CODESYS Gateway-Server to version 2.3.9.27 or later.
3
What systems are affected by CVE-2012-4705?
CVE-2012-4705 affects CODESYS Gateway-Server versions up to 2.3.9.20 and several prior versions.
4
Can CVE-2012-4705 be exploited remotely?
Yes, CVE-2012-4705 can be exploited remotely by sending crafted pathnames to the CODESYS Gateway-Server.
5
Is there a workaround for CVE-2012-4705?
A workaround for CVE-2012-4705 is to restrict access to the CODESYS Gateway-Server to trusted networks.