PT-2022-3534 · Schneider Electric · Conext Combox

Published 2022-06-14 · Updated 2023-02-07 · CVE-2022-32517

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Conext ComBox versions all

Description The issue is related to improper restriction of rendered UI layers or frames in the user interface, which could allow a remote adversary to affect data integrity by tricking the user into interacting with the application in an unintended way. This is due to the product not implementing restrictions on rendering within frames on external addresses.

Recommendations For Conext ComBox versions all, consider restricting the ability to render within frames on external addresses to minimize the risk of exploitation. As a temporary workaround, restrict access to external addresses until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2022-04317

CVE-2022-32517

Affected Products

Conext Combox

References · 7

• https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32517 · Security Note
• https://bdu.fstec.ru/vul/2022-04317 · Security Note
• https://t.me/cibsecurity/57178 · Telegram Post
• https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf · Note
• https://t.me/cvenotify/43800 · Telegram Post
• https://t.me/cvenotify/43154 · Telegram Post