CVE-2022-23854 HIGH

CVE-2022-23854

Vendor Aveva
Product InTouch Access Anywhere
Weakness CWE-23
Published December 23, 2022
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.

Key dates

02Disclosure timeline

December 23, 2022 CVE published
February 13, 2025 Record updated