Lucene search

[email protected]CVE-2022-1018

HistoryApr 01, 2022 - 11:15 p.m.

CVE-2022-1018

2022-04-0123:15:00

CWE-611

[email protected]

web.nvd.nist.gov

cve-2022-1018

xml external entity

dynamic link library

application security

confidentiality loss

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

CPENameOperatorVersion
rockwellautomation:isagrafrockwellautomation isagrafle6.6.9
rockwellautomation:connected_components_workbenchrockwellautomation connected components workbenchle12.0
rockwellautomation:safety_instrumented_systems_workstationrockwellautomation safety instrumented systems workstationle1.1

CPE	Name	Operator	Version
rockwellautomation:isagraf	rockwellautomation isagraf	le	6.6.9
rockwellautomation:connected_components_workbench	rockwellautomation connected components workbench	le	12.0
rockwellautomation:safety_instrumented_systems_workstation	rockwellautomation safety instrumented systems workstation	le	1.1

References

www.cisa.gov/uscert/ics/advisories/icsa-22-088-01

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.0005 Low

EPSS

Percentile

16.4%

JSON

Related for CVE-2022-1018

prion1 ics1