{"id":"CVE-2023-2621","state":"PUBLISHED","title":"CVE-2023-2621","description":"\nThe McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer\nsystem. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can\nexploit this vulnerability by uploading a crafted ZIP archive via the\nnetwork to McFeeder’s service endpoint.\n\n","publishedAt":"2023-11-01T02:10:56.475Z","updatedAt":"2025-02-27T20:37:05.734Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"Hitachi Energy"},"assigner":"Hitachi Energy","products":["Hitachi Energy MACH System Software"],"affected":[{"vendor":"Hitachi Energy","product":"MACH System Software","defaultStatus":"unaffected","versions":[{"version":"5.0","status":"affected","lessThan":"7.17.0.0","versionType":"custom"}]}],"references":["https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/2xxx/CVE-2023-2621.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-2621","state":"PUBLISHED","datePublished":"2023-11-01T02:10:56.475Z","dateUpdated":"2025-02-27T20:37:05.734Z","assignerShortName":"Hitachi Energy","assignerOrgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateReserved":"2023-05-10T08:59:13.964Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"\nThe McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer\nsystem. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can\nexploit this vulnerability by uploading a crafted ZIP archive via the\nnetwork to McFeeder’s service endpoint.\n\n"}],"affected":[{"vendor":"Hitachi Energy","product":"MACH System Software","defaultStatus":"unaffected","versions":[{"version":"5.0","status":"affected","lessThan":"7.17.0.0","versionType":"custom"}]}],"references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Hitachi Energy","orgId":"e383dce4-0c27-4495-91c4-0db157728d17","dateUpdated":"2023-11-01T02:10:56.475Z"},"impacts":[{"capecId":"CAPEC-165","descriptions":[{"lang":"en","value":"CAPEC-165 File Manipulation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:26:09.827Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-26T21:48:43.632226Z","id":"CVE-2023-2621","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-27T20:37:05.734Z"}}]}}}