Lucene search

IcscertCVE-2022-2759

HistoryAug 31, 2022 - 4:15 p.m.

CVE-2022-2759

2022-08-3116:15:11

CWE-611

icscert

web.nvd.nist.gov

delta

electronics

robot

automation

studio

dras

cve-2022-2759

security

vulnerability

xml

document

uri

control

attacker

nvd

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

8.2

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This may allow an attacker to view sensitive documents and information on the affected host.

Affected configurations

Nvd

Node

deltawwdelta_robot_automation_studioRange<1.13.20

VendorProductVersionCPE
deltawwdelta_robot_automation_studio*cpe:2.3:a:deltaww:delta_robot_automation_studio:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
deltaww	delta_robot_automation_studio	*	cpe:2.3:a:deltaww:delta_robot_automation_studio::::::::

CNA Affected

[
  {
    "product": "Delta Robot Automation Studio (DRAS)",
    "vendor": "Delta Electronics",
    "versions": [
      {
        "lessThan": "1.13.20",
        "status": "affected",
        "version": "All versions",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-228-03

Social References

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

8.2

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

Related for CVE-2022-2759