CVE-2022-3092 - Vulnerability Details - OpenCVE

GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ge	Cimplicity

Configuration 1 [-]

cpe:2.3:a:ge:cimplicity:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-12-07T23:01:34.391Z

Updated: 2024-08-03T01:00:09.769Z

Reserved: 2022-09-01T19:32:53.105Z

Link: CVE-2022-3092

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-12-08T00:15:10.453

Modified: 2024-11-21T07:18:48.617

Link: CVE-2022-3092

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-3092", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "requesterUserId": "548e5310-2409-4eaf-9220-2910d23bb95a", "dateReserved": "2022-09-01T19:32:53.105Z", "datePublished": "2022-12-07T23:01:34.391Z", "dateUpdated": "2024-08-03T01:00:09.769Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CIMPLICITY", "vendor": "GE", "versions": [{"lessThanOrEqual": "v2022", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "coordinator", "user": "00000000-0000-4000-9000-000000000000", "value": "Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA."}], "datePublic": "2022-11-22T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">GE CIMPICITY versions 2022 and prior is \n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. </span>\n\n </span>\n\n </span>\n\n </span>\n\n"}], "value": "GE CIMPICITY versions 2022 and prior is \n\n\n\n\n\nvulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. \n\n \n\n \n\n \n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-12-07T23:01:34.391Z"}, "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>GE recommends users refer to the <a target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2\">CIMPLICITY Secure Deployment Guide</a> (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. </p><p>For more information about this issue, see the GE Digital Product <a target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06\">Security Advisory</a> (login required). </p><p>For further questions, users should contact <a target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/communities/CC_Contact\">GE</a>. </p>\n\n<br>"}], "value": "\nGE recommends users refer to the CIMPLICITY Secure Deployment Guide https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2 \u00a0(login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. \n\nFor more information about this issue, see the GE Digital Product Security Advisory https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06 \u00a0(login required). \n\nFor further questions, users should contact GE https://digitalsupport.ge.com/communities/CC_Contact . \n\n\n\n\n"}], "source": {"discovery": "UNKNOWN"}, "title": "GE CIMPLICITY Out-of-bounds Write", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:09.769Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ge:cimplicity:*:*:*:*:*:*:*:*", "matchCriteriaId": "52563130-3092-4815-97A4-D6E95961DD7F", "versionEndIncluding": "2022", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "GE CIMPICITY versions 2022 and prior is \n\n\n\n\n\nvulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. \n\n \n\n \n\n \n\n"}, {"lang": "es", "value": "Las versiones 2022 y anteriores de GE CIMPICITY son vulnerables a una escritura fuera de los l\u00edmites, lo que podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2022-3092", "lastModified": "2024-11-21T07:18:48.617", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-08T00:15:10.453", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}