Description
Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Lion Controls | Crimson 3.0 | affected |
|
||||||
| Red Lion Controls | Crimson 3.1 | affected |
|
||||||
| Red Lion Controls | Crimson 3.2 | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-42519 | Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes. |
References
| Link | Providers |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01 |
|
History
Wed, 16 Apr 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: icscert
Published:
Updated: 2025-04-16T16:06:05.099Z
Reserved: 2022-09-01T00:00:00.000Z
Link: CVE-2022-3090
Vulnrichment
Updated: 2024-08-03T01:00:10.447Z
NVD
Status : Modified
Published: 2022-11-17T22:15:10.700
Modified: 2024-11-21T07:18:48.330
Link: CVE-2022-3090
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses