CVE-2022-42972
First published: Wed Feb 01 2023(Updated: )
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider-electric Apc Easy Ups Online Monitoring Software | <2.5-ga-01-22320 | |
| Microsoft Windows 11 | ||
| Microsoft Windows Server 2019 | ||
| Microsoft Windows Server 2022 | ||
| Schneider-electric Easy Ups Online Monitoring Software | <2.5-gs-01-22320 | |
| Schneider-electric Apc Easy Ups Online Monitoring Software | <2.5-ga | |
| Microsoft Windows 10 | ||
| Microsoft Windows 7 | ||
| Microsoft Windows Server 2016 | ||
| Schneider-electric Easy Ups Online Monitoring Software | <2.5-gs |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-42972.
What is the severity of CVE-2022-42972?
The severity of CVE-2022-42972 is high.
Which products are affected by CVE-2022-42972?
APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022) is affected by CVE-2022-42972.
What is the CWE ID for CVE-2022-42972?
The CWE ID for CVE-2022-42972 is CWE-732.
How can the vulnerability CVE-2022-42972 be exploited?
CVE-2022-42972 can be exploited by a local attacker modifying the webroot directory to cause local privilege escalation.
- agent/type
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/schneider-electric apc easy ups online monitoring software
- vendor/microsoft
- canonical/microsoft windows 11
- canonical/microsoft windows server 2019
- canonical/microsoft windows server 2022
- canonical/schneider-electric easy ups online monitoring software
- canonical/microsoft windows 10
- canonical/microsoft windows 7
- canonical/microsoft windows server 2016