PT-2022-16337 · Ge · Ge Cimpicity

Roman Dvorkin + 1 · Published 2022-02-25 · Updated 2022-03-08 · CVE-2022-23921

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE CIMPLICITY (affected versions not specified)

Description Exploitation of this issue may result in local privilege escalation and code execution. It is noted that exploitation is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-23921

Affected Products

Ge Cimpicity

References · 3

• https://osv.dev/vulnerability/CVE-2022-23921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23921 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-053-01 · Note