CVE-2022-1019

Summary

Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file.

Affected Software

Weaknesses

• CWE-601: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Workarounds

As a manual work around an administrator can add the CSP header/meta tag to each “index.htm” file in each of the directories under “<install_dir>/webroot/_common/lvl5/help/*”. These are the main index files for each help for each program/tool and are all web accessible. Example would read: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self' data:; font-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'">

ADP Enrichment

CVE Program Container

Additional References

• https://www.corporate.carrier.com/Images/CARR-PSA-ALC-WebCTRL-001-1121_tcm558-149395.pdf

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.corporate.carrier.com/Images/CARR-PSA-ALC-WebCTRL-001-1121_tcm558-149395.pdf

• ←Previous
• Next→