CVE-2022-0223

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02249.8dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command CVE-2022-02255.4A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new gro CVE-2022-02264.3livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-02287.2The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in CVE-2022-02298.1The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the recon CVE-2022-02306.1The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the ad CVE-2022-02316.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-02324.8The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via CVE-2022-02335.4The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to in CVE-2022-02346.1The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price CVE-2022-02356.1node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2022-02367.5The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a m