CVE:CVE-2019-13532
CNNVD:CNNVD-201909-657
3S-Smart Software Solutions CODESYS V3 web server是德国3S-Smart Software Solutions公司的一款使用在CODESYS产品中的Web服务器。
3S-Smart Software Solutions CODESYS V3 web server 3.5.14.10之前版本中存在路径遍历漏洞。攻击者可通过发送特制的http或https请求利用该漏洞访问被限制工作目录之外的文件。
solution:Upgrade codesys control_for_beaglebone to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_for_empc-a/imx6 to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_for_iot2000 to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_for_linux to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_for_pfc100 to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_for_pfc200 to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_for_raspberry_pi to a higher version than 3.5.14.10,and avoid the version (,3.5.14.10); Upgrade codesys control_rte to a higher version than 3.5.12.80,3.5.14.10,and avoid the version [3.5.8.60,3.5.12.80),[3.5.13.0,3.5.14.10); Upgrade codesys control_runtime_system_toolkit to a higher version than 3.5.12.80,and avoid the version [3.0,3.5.12.80); Upgrade codesys control_win to a higher version than 3.5.12.80,3.5.14.10,and avoid the version [3.5.9.80,3.5.12.80],[3.5.13.0,3.5.14.10); Upgrade codesys embedded_target_visu_toolkit to a higher version than 3.5.12.80,and avoid the version [3.0,3.5.12.80); Upgrade codesys hmi to a higher version than 3.5.12.80,3.5.14.10,and avoid the version [3.5.10.0,3.5.12.80),[3.5.13.0,3.5.14.10); Upgrade codesys remote_target_visu_toolkit to a higher version than 3.5.12.80,and avoid the version [3.0,3.5.12.80)