PT-2023-14625 · Archibus · Archibus Web Central

Dominique Righetto · Published 2023-01-10 · Updated 2025-04-09 · CVE-2022-45167

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Archibus Web Central version 2022.03.01.107

Description An issue was discovered in the application where a service exposed allows a basic user to access the profile information of all connected users.

Recommendations For Archibus Web Central version 2022.03.01.107, consider restricting access to the exposed service to prevent basic users from accessing profile information of all connected users. As a temporary workaround, restrict the service's functionality until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-45167

Affected Products

Archibus Web Central

References · 6

• https://osv.dev/vulnerability/CVE-2022-45167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45167 · Security Note
• https://t.me/cvenotify/42015 · Telegram Post
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-45167 · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45167 · Note
• https://t.me/cvenotify/118478 · Telegram Post