PT-2023-9778 · Omron · Cx-Motion Pro

Michael Heinzl · Publicado 2023-01-24 · Atualizado 2025-03-27 · CVE-2023-22322

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OMRON CX-Motion Pro versions 1.4.6.013 and earlier

Description The issue is related to an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed.

Recommendations For OMRON CX-Motion Pro versions 1.4.6.013 and earlier, consider avoiding the use of project files from untrusted sources until a patch is available. As a temporary workaround, restrict access to sensitive information in the file system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2024-10609

CVE-2023-22322

Produtos afetados

Cx-Motion Pro

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-22322 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22322 · Nota de Segurança
• https://t.me/cibsecurity/57156 · Publicação no Telegram
• https://t.me/cvenotify/43064 · Publicação no Telegram
• https://jvn.jp/en/vu/JVNVU94200979 · Nota
• https://t.me/cvenotify/116624 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-10609 · Nota de Segurança