Sign-up

ID

VAR-202206-1468


CVE

CVE-2022-32528


TITLE

IGSS Data Server  Vulnerability regarding lack of authentication for critical features in

Trust: 0.8

sources: JVNDB: JVNDB-2022-012001

DESCRIPTION

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project report directory, potentially leading to a denial-of-service condition when an attacker sends specific messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) . IGSS Data Server There is a vulnerability in the lack of authentication for critical features.Information may be obtained and information may be tampered with

Trust: 1.8

sources: NVD: CVE-2022-32528 // JVNDB: JVNDB-2022-012001 // VULHUB: VHN-424569 // VULMON: CVE-2022-32528

AFFECTED PRODUCTS

vendor:schneider electricmodel:interactive graphical scada systemscope:lteversion:15.0.0.22170

Trust: 1.0

vendor:schneider electricmodel:interactive graphical scada systemscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:interactive graphical scada systemscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-012001 // NVD: CVE-2022-32528

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-32528
value: CRITICAL

Trust: 1.0

cybersecurity@se.com: CVE-2022-32528
value: HIGH

Trust: 1.0

NVD: CVE-2022-32528
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202206-2007
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2022-32528
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

cybersecurity@se.com: CVE-2022-32528
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.7
version: 3.1

Trust: 1.0

NVD: CVE-2022-32528
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-012001 // CNNVD: CNNVD-202206-2007 // NVD: CVE-2022-32528 // NVD: CVE-2022-32528

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.1

problemtype:Lack of authentication for critical features (CWE-306) [ others ]

Trust: 0.8

sources: VULHUB: VHN-424569 // JVNDB: JVNDB-2022-012001 // NVD: CVE-2022-32528

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202206-2007

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202206-2007

PATCH

title:SEVD-2022-165-01url:https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-165-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification.pdf

Trust: 0.8

title:Schneider Electric IGSS Data Server Fixes for access control error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=224200

Trust: 0.6

title: - url:https://github.com/Live-Hack-CVE/CVE-2022-32528

Trust: 0.1

sources: VULMON: CVE-2022-32528 // JVNDB: JVNDB-2022-012001 // CNNVD: CNNVD-202206-2007

EXTERNAL IDS

db:NVDid:CVE-2022-32528

Trust: 3.4

db:SCHNEIDERid:SEVD-2022-165-01

Trust: 1.8

db:JVNDBid:JVNDB-2022-012001

Trust: 0.8

db:CS-HELPid:SB2022062010

Trust: 0.6

db:CNNVDid:CNNVD-202206-2007

Trust: 0.6

db:VULHUBid:VHN-424569

Trust: 0.1

db:VULMONid:CVE-2022-32528

Trust: 0.1

sources: VULHUB: VHN-424569 // VULMON: CVE-2022-32528 // JVNDB: JVNDB-2022-012001 // CNNVD: CNNVD-202206-2007 // NVD: CVE-2022-32528

REFERENCES

url:https://download.schneider-electric.com/files?p_doc_ref=sevd-2022-165-01&p_endoctype=security+and+safety+notice&p_file_name=sevd-2022-165-01_igss_security_notification.pdf

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2022-32528

Trust: 0.8

url:https://download.schneider-electric.com/files?p_endoctype=security+and+safety+notice&p_file_name=sevd-2022-165-01_igss_security_notification_v2.pdf

Trust: 0.7

url:https://cxsecurity.com/cveshow/cve-2022-32528/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022062010

Trust: 0.6

url:https://download.schneider-electric.com/files?p_endoctype=security+and+safety+notice&p_file_name=sevd-2022-165-01_igss_security_notification_v2.pdf

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/306.html

Trust: 0.1

url:https://github.com/live-hack-cve/cve-2022-32528

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-424569 // VULMON: CVE-2022-32528 // JVNDB: JVNDB-2022-012001 // CNNVD: CNNVD-202206-2007 // NVD: CVE-2022-32528

SOURCES

db:VULHUBid:VHN-424569
db:VULMONid:CVE-2022-32528
db:JVNDBid:JVNDB-2022-012001
db:CNNVDid:CNNVD-202206-2007
db:NVDid:CVE-2022-32528

LAST UPDATE DATE

2024-08-14T13:53:13.762000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-424569date:2023-02-08T00:00:00
db:VULMONid:CVE-2022-32528date:2023-01-31T00:00:00
db:JVNDBid:JVNDB-2022-012001date:2023-08-25T05:08:00
db:CNNVDid:CNNVD-202206-2007date:2023-05-17T00:00:00
db:NVDid:CVE-2022-32528date:2023-05-16T14:15:09.230

SOURCES RELEASE DATE

db:VULHUBid:VHN-424569date:2023-01-30T00:00:00
db:VULMONid:CVE-2022-32528date:2023-01-30T00:00:00
db:JVNDBid:JVNDB-2022-012001date:2023-08-25T00:00:00
db:CNNVDid:CNNVD-202206-2007date:2022-06-20T00:00:00
db:NVDid:CVE-2022-32528date:2023-01-30T23:15:11.067