jvndb-2022-001923
Vulnerability from jvndb
Published
2022-05-27 15:28
Modified
2024-06-20 11:34
Severity ?
Summary
Multiple vulnerabilities in CONTEC SolarView Compact
Details
SolarView Compact provided by CONTEC CO., LTD. is PV Measurement System. SolarView Compact contains multiple vulnerabilities listed below.
OS command injection (CWE-78) - CVE-2022-29303
Improper validation of input values on the send test mail console of the product's web server may result in OS command injection.
Directory traversal (CWE-23) - CVE-2022-29298
Improper validation of a URL on the download page of the product's web server may allow a remote attacker to view and obtain an arbitrary file.
Information disclosure (CWE-200) - CVE-2022-29302
The hidden page which enables to edit the product's web server contents exists in the product's web server, and a remote attacker to read and/or alter an arbitrary file on the web server via the hidden page.
OS command injection (CWE-78) - CVE-2022-40881
Improper validation of input values on Check Network Communication Page of the product's web server may result in an arbitrary OS command execution.
OS command injection (CWE-78) - CVE-2023-23333
Improper validation of input values on the download page of the product's web server may result in an arbitrary OS command execution.
CVE-2022-29298
Jongheon Yan of S2W Inc reported CONTEC CO., LTD. that the fix for the vulnerability was insufficient in Ver.6.5. CONTEC CO., LTD. and JPCERT/CC updated respective advisories.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | https://jvn.jp/en/vu/JVNVU92327282/index.html | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-29303 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-29298 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-29302 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2022-40881 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2023-23333 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-29303 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-29298 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-29302 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2022-40881 | |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2023-23333 | |
| CISA Known Exploited Vulnerabilities Catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | |
| OS Command Injection(CWE-78) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
| Relative Path Traversal(CWE-23) | https://cwe.mitre.org/data/definitions/23.html | |
| Information Exposure(CWE-200) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-001923.html", "dc:date": "2024-06-20T11:34+09:00", "dcterms:issued": "2022-05-27T15:28+09:00", "dcterms:modified": "2024-06-20T11:34+09:00", description: "SolarView Compact provided by CONTEC CO., LTD. is PV Measurement System. SolarView Compact contains multiple vulnerabilities listed below.\r\n\r\nOS command injection (CWE-78) - CVE-2022-29303\r\nImproper validation of input values on the send test mail console of the product's web server may result in OS command injection.\r\n\r\nDirectory traversal (CWE-23) - CVE-2022-29298\r\nImproper validation of a URL on the download page of the product's web server may allow a remote attacker to view and obtain an arbitrary file.\r\n\r\nInformation disclosure (CWE-200) - CVE-2022-29302\r\nThe hidden page which enables to edit the product's web server contents exists in the product's web server, and a remote attacker to read and/or alter an arbitrary file on the web server via the hidden page.\r\n\r\nOS command injection (CWE-78) - CVE-2022-40881\r\nImproper validation of input values on Check Network Communication Page of the product's web server may result in an arbitrary OS command execution.\r\n\r\nOS command injection (CWE-78) - CVE-2023-23333\r\nImproper validation of input values on the download page of the product's web server may result in an arbitrary OS command execution.\r\n\r\nCVE-2022-29298\r\nJongheon Yan of S2W Inc reported CONTEC CO., LTD. that the fix for the vulnerability was insufficient in Ver.6.5. CONTEC CO., LTD. and JPCERT/CC updated respective advisories.", link: "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-001923.html", "sec:cpe": [ { "#text": "cpe:/o:contec:sv-cpt-mc310f_firmware", "@product": "SolarView Compact SV-CPT-MC310F", "@vendor": "Contec", "@version": "2.2", }, { "#text": "cpe:/o:contec:sv-cpt-mc310f_firmware", "@product": "SolarView Compact SV-CPT-MC310F", "@vendor": "Contec", "@version": "2.2", }, { "#text": "cpe:/o:contec:sv-cpt-mc310_firmware", "@product": "SolarView Compact SV-CPT-MC310", "@vendor": "Contec", "@version": "2.2", }, { "#text": "cpe:/o:contec:sv-cpt-mc310_firmware", "@product": "SolarView Compact SV-CPT-MC310", "@vendor": "Contec", "@version": "2.2", }, ], "sec:cvss": [ { "@score": "5.0", "@severity": "Medium", "@type": "Base", "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "@version": "2.0", }, { "@score": "9.8", "@severity": "Critical", "@type": "Base", "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0", }, ], "sec:identifier": "JVNDB-2022-001923", "sec:references": [ { "#text": "https://jvn.jp/en/vu/JVNVU92327282/index.html", "@id": "JVNVU#92327282", "@source": "JVN", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2022-29303", "@id": "CVE-2022-29303", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2022-29298", "@id": "CVE-2022-29298", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2022-29302", "@id": "CVE-2022-29302", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2022-40881", "@id": "CVE-2022-40881", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-23333", "@id": "CVE-2023-23333", "@source": "CVE", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-29303", "@id": "CVE-2022-29303", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-29298", "@id": "CVE-2022-29298", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-29302", "@id": "CVE-2022-29302", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-40881", "@id": "CVE-2022-40881", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-23333", "@id": "CVE-2023-23333", "@source": "NVD", }, { "#text": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "@id": "CVE-2022-29303", "@source": "CISA Known Exploited Vulnerabilities Catalog", }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-78", "@title": "OS Command Injection(CWE-78)", }, { "#text": "https://cwe.mitre.org/data/definitions/23.html", "@id": "CWE-23", "@title": "Relative Path Traversal(CWE-23)", }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-200", "@title": "Information Exposure(CWE-200)", }, ], title: "Multiple vulnerabilities in CONTEC SolarView Compact", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.