CVE-2022-1704 - OpenCVE

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Inductiveautomation	Ignition

Configuration 1 [-]

OR	cpe:2.3:a:inductiveautomation:ignition::::::::
	cpe:2.3:a:inductiveautomation:ignition::::::::

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-08-05T15:25:19.220733Z

Updated: 2024-09-17T03:01:58.328Z

Reserved: 2022-05-12T00:00:00

Link: CVE-2022-1704

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-08-05T16:15:11.423

Modified: 2022-08-11T13:42:35.150

Link: CVE-2022-1704

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Ignition", "vendor": "Inductive Automation", "versions": [{"lessThanOrEqual": "8.1.7", "status": "affected", "version": "8.1", "versionType": "custom"}, {"lessThan": "7.9.21", "status": "affected", "version": "All", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Keval Shah reported this vulnerability to CISA"}], "datePublic": "2022-07-26T00:00:00", "descriptions": [{"lang": "en", "value": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-05T15:25:19", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}], "solutions": [{"lang": "en", "value": "Inductive Automation recommends users upgrade the Ignition software to the latest version:\n\nInductive Automation Ignition: Version 8.1.9 or later\nInductive Automation Ignition: Version 7.9.21 or later"}], "source": {"advisory": "ICSA-22-207-01", "discovery": "EXTERNAL"}, "title": "Inductive Automation Ignition", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-07-26T17:00:00.000Z", "ID": "CVE-2022-1704", "STATE": "PUBLIC", "TITLE": "Inductive Automation Ignition"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Ignition", "version": {"version_data": [{"version_affected": "<=", "version_name": "8.1", "version_value": "8.1.7"}, {"version_affected": "<", "version_name": "All", "version_value": "7.9.21"}]}}]}, "vendor_name": "Inductive Automation"}]}}, "credit": [{"lang": "eng", "value": "Keval Shah reported this vulnerability to CISA"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}]}, "solution": [{"lang": "en", "value": "Inductive Automation recommends users upgrade the Ignition software to the latest version:\n\nInductive Automation Ignition: Version 8.1.9 or later\nInductive Automation Ignition: Version 7.9.21 or later"}], "source": {"advisory": "ICSA-22-207-01", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:03.916Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1704", "datePublished": "2022-08-05T15:25:19.220733Z", "dateReserved": "2022-05-12T00:00:00", "dateUpdated": "2024-09-17T03:01:58.328Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:*", "matchCriteriaId": "53657378-BA98-47A3-8922-B743A5A76DC1", "versionEndExcluding": "7.9.21", "versionStartIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:*", "matchCriteriaId": "66AA9D0C-35EC-4BE5-84EA-029149AF543C", "versionEndExcluding": "8.1.8", "versionStartIncluding": "8.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup."}, {"lang": "es", "value": "Debido a una vulnerabilidad de tipo XML external entity, el software analiza XML en la funcionalidad backup/restore sin banderas de seguridad XML, lo que puede conllevar a un ataque de tipo XXE al restaurar la copia de seguridad"}], "id": "CVE-2022-1704", "lastModified": "2022-08-11T13:42:35.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-08-05T16:15:11.423", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}