vulnwire
10.0crit

CVE-2024-51549

Absolute Path Traversal

Published 23 mo ago · modified 4 mo ago · JSON

CVSS
10.0
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 46%
Public exploits
0
none known

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products:

ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction (EPSS)

0.54% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.110.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CNA4.09.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
CNA4.09.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.110.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD3.19.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

  • ABB ASPECT-Enterprise
  • ABB NEXUS Series
  • ABB MATRIX Series
  • abb aspect_enterprise
  • abb nexus_series
  • abb matrix_series

Classification

Weakness
  • CWE-36 Absolute Path Traversal
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • search.abb.com /library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=L

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.