172 lines
8.1 KiB
JSON
172 lines
8.1 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-2002",
|
||
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "icscert",
|
||
"requesterUserId": "548e5310-2409-4eaf-9220-2910d23bb95a",
|
||
"dateReserved": "2022-06-06T20:28:22.383Z",
|
||
"datePublished": "2022-12-07T22:56:50.504Z",
|
||
"dateUpdated": "2025-04-16T17:41:56.274Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "CIMPLICITY",
|
||
"vendor": "GE",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "v2022",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "coordinator",
|
||
"user": "00000000-0000-4000-9000-000000000000",
|
||
"value": "Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA."
|
||
}
|
||
],
|
||
"datePublic": "2022-11-22T17:00:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<span style=\"background-color: rgb(255, 255, 255);\">GE CIMPICITY versions 2022 and prior is \n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code. </span>\n\n </span>\n\n </span>\n\n"
|
||
}
|
||
],
|
||
"value": "GE CIMPICITY versions 2022 and prior is \n\n\n\nvulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code. \n\n \n\n \n\n"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "LOCAL",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-822",
|
||
"description": "CWE-822 Untrusted Pointer Dereference",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
|
||
"shortName": "icscert",
|
||
"dateUpdated": "2022-12-07T22:56:50.504Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "\n\n<p>GE recommends users refer to the <a target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2\">CIMPLICITY Secure Deployment Guide</a> (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. </p><p>For more information about this issue, see the GE Digital Product <a target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06\">Security Advisory</a> (login required). </p><p>For further questions, users should contact <a target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/communities/CC_Contact\">GE</a>. </p>\n\n<br>"
|
||
}
|
||
],
|
||
"value": "\nGE recommends users refer to the CIMPLICITY Secure Deployment Guide https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2 (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. \n\nFor more information about this issue, see the GE Digital Product Security Advisory https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06 (login required). \n\nFor further questions, users should contact GE https://digitalsupport.ge.com/communities/CC_Contact . \n\n\n\n\n"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "GE CIMPLICITY Untrusted Pointer Dereference",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-03T00:24:44.102Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-04-16T17:25:46.272621Z",
|
||
"id": "CVE-2022-2002",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-04-16T17:41:56.274Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |