PT-2023-2147 · Hitachi Energy · Sdm600

CVE-2022-3683 · Publicado 2023-03-28 · Atualizado 2023-04-04

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

Description A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vulnerability could read data directly from a data store that is not restricted, or insufficiently protected, having access to sensitive data.

Recommendations For SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291), update to version 1.2 FP3 HF4 or later to resolve the issue. As a temporary workaround, consider restricting access to the SDM600 API web services to minimize the risk of exploitation.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

BDU:2023-01889

CVE-2022-3683

Produtos afetados

Sdm600

Referências · 7

• https://t.me/cibsecurity/60884 · Publicação no Telegram
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Nota
• https://osv.dev/vulnerability/CVE-2022-3683 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-3683 · Nota de Segurança
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01889 · Nota de Segurança
• https://t.me/cvenotify/46991 · Publicação no Telegram