CVE-2023-27856

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In affected versions, path traversal exists when processing a message of type 8

in Rockwell Automation's ThinManager ThinServer.

An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Mar 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-278577.5In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the messaCVE-2023-278587.8Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to comCVE-2023-278596.5IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple dCVE-2023-27864.3Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a chanCVE-2023-278605.3IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used inCVE-2023-278615.9IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by anCVE-2023-278634.9IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be CVE-2023-278645.4IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which wCVE-2023-278669.8IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the applicationCVE-2023-278678.8IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrarCVE-2023-278688.8IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrarCVE-2023-278698.8IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrar
CVE-2023-27856: High severity, CVSS 7.5 | Vulnix