CVE-2022-1373

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
Softing	Secure Integration Server	V1.22

References

https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.htmlMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04Mitigation, Third Party Advisory, US Government Resource
https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.htmlMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Aug 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-13749.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This CVE-2022-13759.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. Thi CVE-2022-13769.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. CVE-2022-13779.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. This CVE-2022-13789.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This CVE-2022-13799.1URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that CVE-2022-13805.4Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is c CVE-2022-13817.8global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software CVE-2022-13825.5NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, t CVE-2022-13836.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the CVE-2022-13848.8Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allow CVE-2022-13854.6Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, wh