Lucene search

IcscertCVELIST:CVE-2022-1467

HistoryMay 23, 2022 - 7:17 p.m.

CVE-2022-1467 AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

2022-05-2319:17:02

CWE-668

icscert

www.cve.org

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

JSON

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.

CNA Affected

[
  {
    "product": "AVEVA InTouch Access Anywhere",
    "vendor": "AVEVA",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "AVEVA Plant SCADA Access Anywhere",
    "vendor": "AVEVA",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  }
]

References

www.aveva.com/en/support-and-success/cyber-security-updates/

www.cisa.gov/uscert/ics/advisories/icsa-22-130-05