Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2 allows an unauthenticated attacker to create, tamper with or destroy arbitrary files by getting a legitimate user import a project package file crafted by the attacker.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-014_en.pdf | mitigation vendor advisory |
| https://jvn.jp/vu/JVNVU95858406/index.html | third party advisory |
| https://iconics.com/About/Security/CERT | vendor advisory |
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01 | third party advisory us government resource |