CVE-2023-2913: Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability
First published: Tue Jul 18 2023(Updated: )
An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists that allows a remote actor to leverage the privileges of the server’s file system and read arbitrary files stored in it. A malicious user could exploit this vulnerability by executing a path that contains manipulating variables.
Credit: PSIRT@rockwellautomation.com PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwellautomation Thinmanager | >=13.0.0<=13.0.2 |
Remedy
* Update to the corrected software versions
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-2913?
CVE-2023-2913 is a vulnerability found in Rockwell Automation ThinManager ThinServer that allows remote actors to exploit a path traversal vulnerability when the API feature is enabled.
What is the severity of CVE-2023-2913?
CVE-2023-2913 has a severity score of 6.5, which is considered high.
How can I fix CVE-2023-2913?
To fix CVE-2023-2913, it is recommended to update Rockwell Automation ThinManager ThinServer to version 13.0.2 or later, as this vulnerability has been fixed in that release.
What is the affected software for CVE-2023-2913?
The affected software for CVE-2023-2913 is Rockwell Automation ThinManager ThinServer versions 13.0.0 to 13.0.2.
Are there any additional resources for CVE-2023-2913?
Yes, you can find additional information about CVE-2023-2913 in the Rockwell Automation knowledgebase article: [https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140160](https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140160)
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/title
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/rockwellautomation
- canonical/rockwellautomation thinmanager
- version/rockwellautomation thinmanager/13.0.0
- version/rockwellautomation thinmanager/13.0.2