CVE-2022-1704 - OpenCVE

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Inductiveautomation	Ignition

Configuration 1 [-]

OR	cpe:2.3:a:inductiveautomation:ignition::::::::
	cpe:2.3:a:inductiveautomation:ignition::::::::

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2022-07-26T00:00:00

Updated: 2022-08-05T15:25:19

Reserved: 2022-05-12T00:00:00

Link: CVE-2022-1704

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-08-05T16:15:11.423

Modified: 2022-08-11T13:42:35.150

Link: CVE-2022-1704

JSON object: View

Redhat Information

No data.

CWE

CWE-611

{"containers": {"cna": {"affected": [{"product": "Ignition", "vendor": "Inductive Automation", "versions": [{"lessThanOrEqual": "8.1.7", "status": "affected", "version": "8.1", "versionType": "custom"}, {"lessThan": "7.9.21", "status": "affected", "version": "All", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Keval Shah reported this vulnerability to CISA"}], "datePublic": "2022-07-26T00:00:00", "descriptions": [{"lang": "en", "value": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-05T15:25:19", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}], "solutions": [{"lang": "en", "value": "Inductive Automation recommends users upgrade the Ignition software to the latest version:\n\nInductive Automation Ignition: Version 8.1.9 or later\nInductive Automation Ignition: Version 7.9.21 or later"}], "source": {"advisory": "ICSA-22-207-01", "discovery": "EXTERNAL"}, "title": "Inductive Automation Ignition", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-07-26T17:00:00.000Z", "ID": "CVE-2022-1704", "STATE": "PUBLIC", "TITLE": "Inductive Automation Ignition"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Ignition", "version": {"version_data": [{"version_affected": "<=", "version_name": "8.1", "version_value": "8.1.7"}, {"version_affected": "<", "version_name": "All", "version_value": "7.9.21"}]}}]}, "vendor_name": "Inductive Automation"}]}}, "credit": [{"lang": "eng", "value": "Keval Shah reported this vulnerability to CISA"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}]}, "solution": [{"lang": "en", "value": "Inductive Automation recommends users upgrade the Ignition software to the latest version:\n\nInductive Automation Ignition: Version 8.1.9 or later\nInductive Automation Ignition: Version 7.9.21 or later"}], "source": {"advisory": "ICSA-22-207-01", "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1704", "datePublished": "2022-07-26T00:00:00", "dateReserved": "2022-05-12T00:00:00", "dateUpdated": "2022-08-05T15:25:19", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:*", "matchCriteriaId": "53657378-BA98-47A3-8922-B743A5A76DC1", "versionEndExcluding": "7.9.21", "versionStartIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:*", "matchCriteriaId": "66AA9D0C-35EC-4BE5-84EA-029149AF543C", "versionEndExcluding": "8.1.8", "versionStartIncluding": "8.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup."}, {"lang": "es", "value": "Debido a una vulnerabilidad de tipo XML external entity, el software analiza XML en la funcionalidad backup/restore sin banderas de seguridad XML, lo que puede conllevar a un ataque de tipo XXE al restaurar la copia de seguridad"}], "id": "CVE-2022-1704", "lastModified": "2022-08-11T13:42:35.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-08-05T16:15:11.423", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}