CVE-2022-0221

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.se.com/ww/en/download/document/SEVD-2022-087-01/	Mitigation Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2022-087-01/	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:schneider-electric:scadapack_workbench:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:38

Type	Values Removed	Values Added
References	~~() https://www.se.com/ww/en/download/document/SEVD-2022-087-01/ - Mitigation, Vendor Advisory~~	() https://www.se.com/ww/en/download/document/SEVD-2022-087-01/ - Mitigation, Vendor Advisory

Information

Published : 2022-04-13 16:15

Updated : 2024-11-21 06:38

NVD link : CVE-2022-0221

Mitre link : CVE-2022-0221

CVE.ORG link : CVE-2022-0221

JSON object : View

Products Affected

schneider-electric

scadapack_workbench

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2022-0221", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "cybersecurity@se.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-04-13T16:15:09.607", "references": [{"url": "https://www.se.com/ww/en/download/document/SEVD-2022-087-01/", "tags": ["Mitigation", "Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://www.se.com/ww/en/download/document/SEVD-2022-087-01/", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)"}, {"lang": "es", "value": "Una CWE-611: Se presenta una vulnerabilidad de Restricci\u00f3n Inapropiada de la referencia de tipo XML External Entity que podr\u00eda resultar en una divulgaci\u00f3n de informaci\u00f3n cuando es abierto un archivo de soluci\u00f3n malicioso proporcionado por un atacante con SCADAPack Workbench. Esto podr\u00eda ser explotado para pasar datos de archivos locales a un sistema remoto controlado por un atacante. Producto afectado: SCADAPack Workbench (versiones 6.6.8a y anteriores)"}], "lastModified": "2024-11-21T06:38:10.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:scadapack_workbench:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAB6601F-F1B4-4906-B2EE-EB75CF84E911", "versionEndIncluding": "6.6.8a"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}