PT-2023-14017 · Visam · Visam Vbase Automation Base

Kimiya · Published 2023-03-21 · Updated 2025-01-17 · CVE-2022-41696

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VISAM VBASE Automation Base versions prior to 11.7.5

Description The issue may disclose information if a valid user opens a specially crafted file. This is related to XML External Entity Processing in the FB.XML file parsing.

Recommendations For versions prior to 11.7.5, update to version 11.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to specially crafted files until the update is applied. Avoid using the FB.XML file parsing feature with untrusted files until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-41696

ZDI-23-1042

Affected Products

Visam Vbase Automation Base

References · 7

• https://zerodayinitiative.com/advisories/ZDI-23-1042 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41696 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41696 · Vendor Advisory
• https://t.me/cvenotify/46603 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-080-05 · Note
• https://t.me/cvenotify/46592 · Telegram Post
• https://t.me/cvenotify/107844 · Telegram Post