CVE-2022-2948
Assigner: icscert
Published: 2022-12-07T22:58:15.094Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CIMPLICITY
vendor: GE
versions: lessThanOrEqual: v2022
status: affected
version: 0
versionType: custom
credits: type: coordinator
user: 00000000-0000-4000-9000-000000000000
value: Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA.
datePublic: 2022-11-22T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">GE CIMPICITY versions 2022 and prior is 

<span style="background-color: rgb(255, 255, 255);">vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code. </span>

 </span>


value: GE CIMPICITY versions 2022 and prior is 

vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code. 

 


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-122
description: CWE-122 Heap-based Buffer Overflow
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<p>GE recommends users refer to the <a target="_blank" rel="nofollow" href="https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2">CIMPLICITY Secure Deployment Guide</a>&nbsp;(login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. </p><p>For more information about this issue, see the GE Digital Product <a target="_blank" rel="nofollow" href="https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06">Security Advisory</a>&nbsp;(login required). </p><p>For further questions, users should contact <a target="_blank" rel="nofollow" href="https://digitalsupport.ge.com/communities/CC_Contact">GE</a>. </p>

<br>
value: 
GE recommends users refer to the  CIMPLICITY Secure Deployment Guide https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2  (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. 

For more information about this issue, see the GE Digital Product  Security Advisory https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06  (login required). 

For further questions, users should contact  GE https://digitalsupport.ge.com/communities/CC_Contact . 





source: discovery: UNKNOWN
title: GE CIMPLICITY Heap-based Buffer Overflow
x_generator: engine: Vulnogram 0.1.0-dev