CVE-2022-26067

Name of the Vulnerable Software and Affected Versions Open Automation Software OAS Platform version 16.00.0112

Description An information disclosure issue exists in the OAS Engine SecureTransferFiles functionality. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this issue.

Recommendations For version 16.00.0112, consider restricting access to the SecureTransferFiles functionality until a fix is available. As a temporary workaround, limit the ability to send sequences of requests to the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.