PT-2022-14058 · Inductive Automation · Ignition

Keval Shah · Published 2022-08-05 · Updated 2022-08-11 · CVE-2022-1704

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue arises from an XML external entity reference, where the software fails to use XML security flags when parsing XML in the backup/restore functionality. This oversight may lead to an XXE attack during the restoration of a backup.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-1704

Affected Products

Ignition

References · 4

• https://osv.dev/vulnerability/CVE-2022-1704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1704 · Security Note
• https://t.me/cibsecurity/47635 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-207-01 · Note