Skip to content
OpenAdvisories
High ICSA-22-174-05 3 CVEs

Elcomplus SmartICS

Published Jun 23, 2022 · Updated Jun 23, 2022

Vendor: Elcomplus Product: SmartICS

Summary

Successful exploitation of these vulnerabilities could allow an attacker to view files on the system or terminate processes on the system.

Vulnerabilities 3

  • High 8.8
    CVE-2022-2140

    Elcomplus SmartICS Cross-site Scripting

    Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.

    Elcomplus SmartICS
  • Medium 6.8
    CVE-2022-2088

    Elcomplus SmartICS Access Control

    An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.

    Elcomplus SmartICS
  • Low 3.8
    CVE-2022-2106

    Elcomplus SmartICS Path Traversal

    Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.

    Elcomplus SmartICS

Revision history

  1. #1

    Publication Date

References