Vulnerability · Published Jan 3, 2023 · Assigned by twcert
CVE-2022-46306ChangingTec ServiSign - Path Traversal
High 8.8
In plain English
A high-severity path traversal in ServiSign from ChangingTec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers the component to load malicious DLL files under arbitrary file path and allows the attacker to perform arbitrary system operation and disrupt of service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ChangingTec | ServiSign | see references |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H