PT-2022-3527 · Elcomplus · Elcomplus Smartics

Michael Heinzl · Published 2022-06-23 · Updated 2022-07-06 · CVE-2022-2140

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elcomplus SmartICS version 2.3.4.0

Description The issue is related to the lack of input data sanitization, which allows an authenticated user to inject arbitrary code into specific parameters. This can lead to cross-site scripting (XSS) attacks, enabling a remote attacker to perform malicious actions.

Recommendations For Elcomplus SmartICS version 2.3.4.0, consider restricting access to user-controllable input parameters until a patch is available. As a temporary workaround, disabling the injection of arbitrary code into specific parameters can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04310

CVE-2022-2140

Affected Products

Elcomplus Smartics

References · 7

• https://osv.dev/vulnerability/CVE-2022-2140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2140 · Security Note
• https://bdu.fstec.ru/vul/2022-04310 · Security Note
• https://cybersecurity-help.cz/vdb/SB2022062708 · Note
• https://t.me/cibsecurity/45194 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-174-05 · Note
• https://t.me/cvenotify/32712 · Telegram Post