6.7med
CVE-2017-14019
An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 35%
Public exploits
0
none known
Summary
An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted search path or element vulnerability has been identified, which may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate his or her privileges.
Exploit prediction (EPSS)
0.41% probability of exploitation in the next 30 days, higher than 35% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.7 | CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a Progea Movicon SCADA/HMI
Classification
- Weakness
- CWE-428 Unquoted Search Path or Element
References
- securityfocus.com /bid/101483 · vdb-entry, x_refsource_BID, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-17-290-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-14019
- NVD: CVE-2017-14019
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.