PT-2022-23009 · Bentley · Bentley View+2

Xina1I · Published 2022-07-15 · Updated 2022-07-21 · CVE-2022-35901

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bentley MicroStation versions prior to 10.17.0.x Bentley View versions prior to 10.17.0.x

Description An issue was discovered in the parsing of J2K files, which can force an out-of-bounds read when using an affected version of MicroStation or MicroStation-based application to open a J2K file containing crafted data. This could enable an attacker to read information in the context of the current process.

Recommendations For Bentley MicroStation versions prior to 10.17.0.x, update to version 10.17.0.x or later to resolve the issue. For Bentley View versions prior to 10.17.0.x, update to version 10.17.0.x or later to resolve the issue. As a temporary workaround, consider avoiding the use of J2K files in affected versions of MicroStation or MicroStation-based applications until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-35901

Affected Products

Bentley View

Microstation

Microstation-Based Application

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-35901 · Security Note
• https://bentley.com/en/common-vulnerability-exposure/be-2022-0014 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35901 · Vendor Advisory
• https://t.me/cvenotify/33186 · Telegram Post