PT-2023-14676 · Visam · Visam Vbase Automation Base

Kimiya · Published 2023-03-21 · Updated 2025-01-17 · CVE-2022-45468

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VISAM VBASE Automation Base versions prior to 11.7.5

Description The issue may disclose information if a valid user opens a specially crafted file. This occurs due to improper handling of XML External Entity (XXE) processing in the file parsing mechanism.

Recommendations For versions prior to 11.7.5, update to version 11.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to specially crafted files until the update is applied. Avoid using the VBASE-Editor LayerSettings file parsing feature with untrusted files until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-45468

ZDI-23-1039

Affected Products

Visam Vbase Automation Base

References · 7

• https://osv.dev/vulnerability/CVE-2022-45468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45468 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1039 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-080-05 · Note
• https://t.me/cvenotify/46746 · Telegram Post
• https://t.me/cvenotify/46600 · Telegram Post
• https://t.me/cvenotify/46589 · Telegram Post