A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.
References
| Link | Resource |
|---|---|
| https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html | Broken Link |
| https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
21 Oct 2022, 18:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 |
21 Apr 2022, 20:32
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Bbraun spacecom
Bbraun Bbraun datamodule Compactplus |
|
| CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 8.8 |
| References | (CONFIRM) https://www.bbraun.com/en/products-and-therapies/services/b-braun-vulnerability-disclosure-policy/security-advisory.html - Broken Link | |
| References | (CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsma-20-296-02 - Third Party Advisory, US Government Resource | |
| CPE | cpe:2.3:h:bbraun:spacecom:-:*:*:*:*:*:*:* cpe:2.3:h:bbraun:datamodule_compactplus:-:*:*:*:*:*:*:* cpe:2.3:o:bbraun:datamodule_compactplus:a10:*:*:*:*:*:*:* cpe:2.3:o:bbraun:spacecom:*:*:*:*:*:*:*:* cpe:2.3:o:bbraun:datamodule_compactplus:a11:*:*:*:*:*:*:* |
14 Apr 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-14 21:15
Updated : 2023-12-10 14:22
NVD link : CVE-2020-25150
Mitre link : CVE-2020-25150
CVE.ORG link : CVE-2020-25150
JSON object : View
Products Affected
bbraun
- spacecom
- datamodule_compactplus