PT-2022-6267 · Unknown · Scadapack Workbench

Published 2022-03-28 · Updated 2022-04-21 · CVE-2022-0221

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SCADAPack Workbench versions 6.6.8a and prior

Description A vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker.

Recommendations For SCADAPack Workbench versions 6.6.8a and prior, consider disabling the XML external entity reference functionality until a patch is available to prevent information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-00682

CVE-2022-0221

ZDI-22-582

ZDI-22-583

Affected Products

Scadapack Workbench

References · 8

• https://se.com/ww/en/download/document/SEVD-2022-087-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0221 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-582 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-583 · Security Note
• https://bdu.fstec.ru/vul/2023-00682 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0221 · Vendor Advisory
• https://vuldb.com/ru/?id.197286 · Note
• https://t.me/cibsecurity/40733 · Telegram Post