GE Vernova Smallworld Path Traversal Vulnerability Allowing Arbitrary File Manipulation

A path traversal vulnerability has been identified in GE Vernova Smallworld Master File Server (SWMFS) versions through 5.3.5 on Windows and Linux. This vulnerability allows users to arbitrarily manipulate files on the server, including retrieving, modifying, uploading, or deleting critical files. The issue can only be exploited by users with knowledge of the system.

Impact

Exploitation of this vulnerability could lead to unauthorized file manipulation on the server, with potential to disrupt critical operations by altering or deleting essential files.

Remediation

GE Vernova has released a patch in SWMFS version 5.3.6. Users are advised to upgrade to this version and follow the Secure Deployment Guide instructions available in the Smallworld Documentation. To obtain the latest version, contact your local support representative at Customer Center.