CVE-2023-5101

Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json	Vendor Advisory
https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf	Vendor Advisory
https://sick.com/psirt	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sick:apu0200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sick:apu0200:-:*:*:*:*:*:*:*

History

11 Oct 2023, 18:41

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
References	~~(MISC) https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json -~~	(MISC) https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json - Vendor Advisory
References	~~(MISC) https://sick.com/psirt -~~	(MISC) https://sick.com/psirt - Product
References	~~(MISC) https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf -~~	(MISC) https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf - Vendor Advisory
CWE		CWE-552
CPE		cpe:2.3:h:sick:apu0200:-:::::::* cpe:2.3:o:sick:apu0200_firmware::::::::
First Time		Sick apu0200 Sick apu0200 Firmware Sick

09 Oct 2023, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-09 13:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-5101

Mitre link : CVE-2023-5101

CVE.ORG link : CVE-2023-5101

JSON object : View

Products Affected

sick

apu0200
apu0200_firmware

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2023-5101", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@sick.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-10-09T13:15:10.557", "references": [{"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf", "tags": ["Vendor Advisory"], "source": "psirt@sick.de"}, {"url": "https://sick.com/psirt", "tags": ["Product"], "source": "psirt@sick.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-552"}]}, {"type": "Secondary", "source": "psirt@sick.de", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "\nFiles or Directories Accessible to External Parties in RDT400 in SICK APU allows an\nunprivileged remote attacker to download various files from the server via HTTP requests.\n\n"}, {"lang": "es", "value": "Archivos o directorios accesibles a partes externas en RDT400 en SICK APU permiten a un atacante remoto sin privilegios descargar varios archivos desde el servidor a trav\u00e9s de solicitudes HTTP."}], "lastModified": "2023-10-11T18:41:21.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sick:apu0200_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2A3C873-A9B5-4AF8-8703-F00233E56A5E", "versionEndExcluding": "4.0.0.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sick:apu0200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0E32F3FD-FB2B-4F73-AD20-8AB98B02FCF1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@sick.de"}