{"id":"CVE-2023-3670","state":"PUBLISHED","title":"Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting","description":"In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.","publishedAt":"2023-07-28T07:52:33.639Z","updatedAt":"2024-10-21T17:43:52.386Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["CODESYS CODESYS Development System","CODESYS CODESYS Scripting"],"affected":[{"vendor":"CODESYS","product":"CODESYS Development System","defaultStatus":"unaffected","versions":[{"version":"3.5.9.0","status":"affected","lessThan":"3.5.17.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Scripting","defaultStatus":"unaffected","versions":[{"version":"4.0.0.0","status":"affected","lessThan":"4.1.0.0","versionType":"semver"}]}],"references":["https://cert.vde.com/en/advisories/VDE-2023-024"],"weaknesses":["CWE-668"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3670.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-3670","state":"PUBLISHED","datePublished":"2023-07-28T07:52:33.639Z","dateUpdated":"2024-10-21T17:43:52.386Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2023-07-14T07:43:16.307Z"},"containers":{"cna":{"title":"Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting","descriptions":[{"lang":"en","value":"In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users."}],"affected":[{"vendor":"CODESYS","product":"CODESYS Development System","defaultStatus":"unaffected","versions":[{"version":"3.5.9.0","status":"affected","lessThan":"3.5.17.0","versionType":"semver"}]},{"vendor":"CODESYS","product":"CODESYS Scripting","defaultStatus":"unaffected","versions":[{"version":"4.0.0.0","status":"affected","lessThan":"4.1.0.0","versionType":"semver"}]}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2023-024"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-668","description":"CWE-668 Exposure of Resource to Wrong Sphere","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2023-07-28T07:52:33.639Z"},"datePublic":"2023-07-28T07:45:00.000Z","source":{"advisory":"VDE-2023-024","defect":["CERT@VDE#64563"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert.vde.com/en/advisories/VDE-2023-024","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:01:57.057Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-21T17:43:39.441777Z","id":"CVE-2023-3670","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-21T17:43:52.386Z"}}]}}}