Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition.
The product allows user input to control or influence paths or file names that are used in filesystem operations.
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
| Link | Tags |
|---|---|
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-016_en.pdf | mitigation vendor advisory |
| https://jvn.jp/vu/JVNVU93383160/ | government resource mitigation third party advisory |