PT-2022-23012 · Bentley · Bentley View+1

Xina1I · Published 2022-07-15 · Updated 2022-07-21 · CVE-2022-35904

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions Bentley MicroStation versions prior to 10.17.0.x Bentley View versions prior to 10.17.0.x

Description An issue was discovered in the affected software. Using an affected version to open an IFC file containing crafted data can force an out-of-bounds read. Exploitation of this issue within the parsing of IFC files could enable an attacker to read information in the context of the current process.

Recommendations For Bentley MicroStation versions prior to 10.17.0.x, update to version 10.17.0.x or later. For Bentley View versions prior to 10.17.0.x, update to version 10.17.0.x or later. As a temporary workaround, consider avoiding the use of IFC files from untrusted sources until a patch is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-35904

Affected Products

Bentley Microstation

Bentley View

References · 4

• https://bentley.com/en/common-vulnerability-exposure/be-2022-0013 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35904 · Security Note
• https://t.me/cvenotify/33183 · Telegram Post