CVE-2023-2913: Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability
An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists that allows a remote actor to leverage the privileges of the server’s file system and read arbitrary files stored in it. A malicious user could exploit this vulnerability by executing a path that contains manipulating variables.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-2913?
CVE-2023-2913 is a vulnerability found in Rockwell Automation ThinManager ThinServer that allows remote actors to exploit a path traversal vulnerability when the API feature is enabled.
What is the severity of CVE-2023-2913?
CVE-2023-2913 has a severity score of 6.5, which is considered high.
How can I fix CVE-2023-2913?
To fix CVE-2023-2913, it is recommended to update Rockwell Automation ThinManager ThinServer to version 13.0.2 or later, as this vulnerability has been fixed in that release.
What is the affected software for CVE-2023-2913?
The affected software for CVE-2023-2913 is Rockwell Automation ThinManager ThinServer versions 13.0.0 to 13.0.2.
Are there any additional resources for CVE-2023-2913?
Yes, you can find additional information about CVE-2023-2913 in the Rockwell Automation knowledgebase article: [https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140160](https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140160)