PT-2022-3905 · Open Design Alliance · Open Design Alliance Drawings Sdk

Published 2022-04-08 · Updated 2022-07-25 · CVE-2022-28807

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2023.2

Description An issue exists when rendering a .dwg file after it's opened in the recovery mode, allowing an Out-of-Bounds Read. This can be leveraged by an attacker to execute code in the context of the current process.

Recommendations For versions prior to 2023.2, update to version 2023.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the recovery mode when opening .dwg files until a patch is available. Restrict access to .dwg files to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-04717

CVE-2022-28807

Affected Products

Open Design Alliance Drawings Sdk

References · 7

• https://opendesign.com/security-advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04717 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28807 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28807 · Vendor Advisory
• https://t.me/cibsecurity/46413 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-429204.pdf · Note
• https://cert-portal.siemens.com/productcert/html/ssa-137900.html · Note