Sign-up

ID

VAR-202207-1128


CVE

CVE-2022-35869


TITLE

Inductive Automation  of  Ignition  Authentication Bypass Vulnerability Using Alternate Paths or Channels in

Trust: 0.8

sources: JVNDB: JVNDB-2022-013801

DESCRIPTION

This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within com.inductiveautomation.ignition.gateway.web.pages. The issue results from the lack of proper authentication prior to access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17211. (DoS) It may be in a state. Inductive Automation Ignition‌ is a comprehensive platform for industrial automation that provides scalable solutions for monitoring, control, data collection and analysis. Ignition was developed by Inductive Automation to help users build and deploy automation systems that meet specific needs‌

Trust: 2.88

sources: NVD: CVE-2022-35869 // JVNDB: JVNDB-2022-013801 // ZDI: ZDI-22-1016 // CNVD: CNVD-2024-48769 // VULMON: CVE-2022-35869

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-48769

AFFECTED PRODUCTS

vendor:inductive automationmodel:ignitionscope: - version: -

Trust: 1.5

vendor:inductiveautomationmodel:ignitionscope:eqversion:8.1.15

Trust: 1.0

vendor:inductive automationmodel:ignitionscope:eqversion: -

Trust: 0.8

vendor:inductive automationmodel:ignitionscope:eqversion:8.1.15

Trust: 0.8

vendor:inductivemodel:automation inductive automation ignitionscope:gteversion:7.9.0,<=8.1.16

Trust: 0.6

sources: ZDI: ZDI-22-1016 // CNVD: CNVD-2024-48769 // JVNDB: JVNDB-2022-013801 // NVD: CVE-2022-35869

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-35869
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-35869
value: CRITICAL

Trust: 1.0

NVD: CVE-2022-35869
value: CRITICAL

Trust: 0.8

ZDI: CVE-2022-35869
value: HIGH

Trust: 0.7

CNVD: CNVD-2024-48769
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202207-1495
value: CRITICAL

Trust: 0.6

CNVD: CNVD-2024-48769
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-35869
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-35869
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-35869
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-35869
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1016 // CNVD: CNVD-2024-48769 // JVNDB: JVNDB-2022-013801 // CNNVD: CNNVD-202207-1495 // NVD: CVE-2022-35869 // NVD: CVE-2022-35869

PROBLEMTYPE DATA

problemtype:CWE-288

Trust: 1.0

problemtype:Authentication Bypass Using Alternate Paths or Channels (CWE-288) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-013801 // NVD: CVE-2022-35869

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-1495

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202207-1495

PATCH

title:Inductive Automation has issued an update to correct this vulnerability.url:https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities

Trust: 0.7

title:Patch for Inductive Automation Ignition Improper Authentication Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/644331

Trust: 0.6

title:Inductive Automation Ignition Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=203741

Trust: 0.6

sources: ZDI: ZDI-22-1016 // CNVD: CNVD-2024-48769 // CNNVD: CNNVD-202207-1495

EXTERNAL IDS

db:NVDid:CVE-2022-35869

Trust: 4.6

db:ZDIid:ZDI-22-1016

Trust: 3.2

db:CS-HELPid:SB2022071816

Trust: 1.2

db:JVNDBid:JVNDB-2022-013801

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-17211

Trust: 0.7

db:CNVDid:CNVD-2024-48769

Trust: 0.6

db:CNNVDid:CNNVD-202207-1495

Trust: 0.6

db:VULMONid:CVE-2022-35869

Trust: 0.1

sources: ZDI: ZDI-22-1016 // CNVD: CNVD-2024-48769 // VULMON: CVE-2022-35869 // JVNDB: JVNDB-2022-013801 // CNNVD: CNNVD-202207-1495 // NVD: CVE-2022-35869

REFERENCES

url:https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-regarding-pwn2own-2022-vulnerabilities

Trust: 3.2

url:https://www.zerodayinitiative.com/advisories/zdi-22-1016/

Trust: 2.5

url:https://www.cybersecurity-help.cz/vdb/sb2022071816

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-35869

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-35869/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/288.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-1016 // CNVD: CNVD-2024-48769 // VULMON: CVE-2022-35869 // JVNDB: JVNDB-2022-013801 // CNNVD: CNNVD-202207-1495 // NVD: CVE-2022-35869

CREDITS

@_s_n_t of @pentestltd

Trust: 0.7

sources: ZDI: ZDI-22-1016

SOURCES

db:ZDIid:ZDI-22-1016
db:CNVDid:CNVD-2024-48769
db:VULMONid:CVE-2022-35869
db:JVNDBid:JVNDB-2022-013801
db:CNNVDid:CNNVD-202207-1495
db:NVDid:CVE-2022-35869

LAST UPDATE DATE

2024-12-21T22:55:55.566000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1016date:2022-07-15T00:00:00
db:CNVDid:CNVD-2024-48769date:2024-12-20T00:00:00
db:VULMONid:CVE-2022-35869date:2022-07-26T00:00:00
db:JVNDBid:JVNDB-2022-013801date:2023-09-12T08:18:00
db:CNNVDid:CNNVD-202207-1495date:2022-08-10T00:00:00
db:NVDid:CVE-2022-35869date:2022-08-03T16:56:53.823

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1016date:2022-07-15T00:00:00
db:CNVDid:CNVD-2024-48769date:2022-12-26T00:00:00
db:VULMONid:CVE-2022-35869date:2022-07-25T00:00:00
db:JVNDBid:JVNDB-2022-013801date:2023-09-12T00:00:00
db:CNNVDid:CNNVD-202207-1495date:2022-07-18T00:00:00
db:NVDid:CVE-2022-35869date:2022-07-25T19:15:44.017