Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-31218

Drive Composer Link Following Local Privilege Escalation Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ABB

Description

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ABB Drive Composer entry

Default version status: unaffected

  • 2.0 to < unspecifiedaffected
  • unspecified to ≤ 2.7affected

ABB Drive Composer pro

Default version status: unaffected

  • 2.0 to < unspecifiedaffected
  • unspecified to ≤ 2.7affected

ABB ABB Automation Builder

Default version status: unaffected

  • 1.1.0 to < unspecifiedaffected
  • unspecified to ≤ 2.5.0affected

ABB Mint WorkBench

Default version status: unaffected

  • build to ≤ 5866affected

References