CVE-2022-2952
Assigner: icscert
Published: 2022-12-07T22:59:10.715Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CIMPLICITY
vendor: GE
versions: lessThanOrEqual: v2022
status: affected
version: 0
versionType: custom
credits: type: coordinator
user: 00000000-0000-4000-9000-000000000000
value: Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA.
datePublic: 2022-11-22T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">GE CIMPICITY versions 2022 and prior is 

<span style="background-color: rgb(255, 255, 255);">vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.</span>

 </span>


value: GE CIMPICITY versions 2022 and prior is 

vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.

 


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-824
description: CWE-824 Access of Uninitialized Pointer
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<p>GE recommends users refer to the <a target="_blank" rel="nofollow" href="https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2">CIMPLICITY Secure Deployment Guide</a>&nbsp;(login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. </p><p>For more information about this issue, see the GE Digital Product <a target="_blank" rel="nofollow" href="https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06">Security Advisory</a>&nbsp;(login required). </p><p>For further questions, users should contact <a target="_blank" rel="nofollow" href="https://digitalsupport.ge.com/communities/CC_Contact">GE</a>. </p>

<br>
value: 
GE recommends users refer to the  CIMPLICITY Secure Deployment Guide https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2  (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. 

For more information about this issue, see the GE Digital Product  Security Advisory https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06  (login required). 

For further questions, users should contact  GE https://digitalsupport.ge.com/communities/CC_Contact . 





source: discovery: UNKNOWN
title: GE CIMPLICITY Access of Uninitialized Pointer
x_generator: engine: Vulnogram 0.1.0-dev