PT-2023-2167 · Hitachi Energy · Sdm600

CVE-2022-3684 · Publicado 2023-03-28 · Atualizado 2023-04-04

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

Description A vulnerability exists in the SDM600 endpoint, where an attacker could exploit this issue by running multiple parallel requests, causing the SDM600 web services to become busy and rendering the application unresponsive. The vulnerability is related to incorrect clearance or release of resources.

Recommendations For SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291), update to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291) or later to resolve the issue. As a temporary workaround, consider restricting access to the SDM600 endpoint to minimize the risk of exploitation.

Correção

Improper Resource Release

Enumeração de Fraquezas

CWE-404

Identificadores relacionados

BDU:2023-01909

CVE-2022-3684

Produtos afetados

Sdm600

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-3684 · Nota de Segurança
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Nota
• https://bdu.fstec.ru/vul/2023-01909 · Nota de Segurança
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch · Aviso do Fabricante
• https://t.me/cibsecurity/60887 · Publicação no Telegram
• https://t.me/cvenotify/46990 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-3684 · Aviso do Fabricante