Lucene search

[email protected]CVE-2022-22732

HistoryJan 30, 2023 - 11:15 p.m.

CVE-2022-22732

2023-01-3023:15:09

CWE-668

[email protected]

web.nvd.nist.gov

cve-2022-22732

cwe-668

ecostruxure power commission

data exposure

information security

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

48.7%

JSON

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)

CPENameOperatorVersion
schneider-electric:ecostruxure_power_commissionschneider-electric ecostruxure power commissionlt2.22
schneider-electric:ecostruxure_power_commissionschneider-electric ecostruxure power commissioneq-

CPE	Name	Operator	Version
schneider-electric:ecostruxure_power_commission	schneider-electric ecostruxure power commission	lt	2.22
schneider-electric:ecostruxure_power_commission	schneider-electric ecostruxure power commission	eq	-

References

download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

48.7%

JSON

Related for CVE-2022-22732

prion1