Lucene search

CERTVDECVELIST:CVE-2022-1989

HistoryJun 03, 2022 - 12:00 a.m.

CVE-2022-1989 CODESYS Visualization vulnerable to user enumeration

2022-06-0300:00:00

CWE-204

CERTVDE

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.2%

JSON

All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.

CNA Affected

[
  {
    "product": "CODESYS Visualization",
    "vendor": "CODESYS",
    "versions": [
      {
        "lessThan": "V4.2.0.0",
        "status": "affected",
        "version": "V3",
        "versionType": "custom"
      }
    ]
  }
]

References

customers.codesys.com/index.php?eID=dumpFile&t=f&f=17142&token=a3696ab41fef800d2eaee8043d40d5fbe94277fd&download=

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.2%

JSON

Related for CVELIST:CVE-2022-1989