Details of VAR-202301-1796

ID

VAR-202301-1796

CVE

CVE-2023-22322

TITLE

Made by Omron CX-Motion Pro In XML External entity reference ( XXE ) vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2023-001110

DESCRIPTION

Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed. This vulnerability information is JPCERT/CC Report to JPCERT/CC Coordinated with the developer

Trust: 1.8

sources: NVD: CVE-2023-22322 // JVNDB: JVNDB-2023-001110 // VULHUB: VHN-449931 // VULMON: CVE-2023-22322

AFFECTED PRODUCTS

vendor:	omron	model:	cx-motion pro	scope:	lt	version:	1.4.6.014	Trust: 1.0
vendor:	オムロン株式会社	model:	cx-motion pro	scope:	lte	version:	1.4.6.013 and earlier	Trust: 0.8
vendor:	オムロン株式会社	model:	cx-motion pro	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-001110 // NVD: CVE-2023-22322

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-22322
value:	MEDIUM
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2023-22322
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2023-001110
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202301-1785
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2023-22322
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 2.0
OTHER:	JVNDB-2023-001110
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-001110 // CNNVD: CNNVD-202301-1785 // NVD: CVE-2023-22322 // NVD: CVE-2023-22322

PROBLEMTYPE DATA

problemtype:	CWE-611	Trust: 1.1
problemtype:	XML Improper restriction of external entity references (CWE-611) [ others ]	Trust: 0.8

sources: VULHUB: VHN-449931 // JVNDB: JVNDB-2023-001110 // NVD: CVE-2023-22322

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202301-1785

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202301-1785

PATCH

title:	Information from Omron Corporation	url:	https://jvn.jp/vu/JVNVU94200979/995504/index.html	Trust: 0.8
title:	CX-Motion Pro Fixes for code issue vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=224065	Trust: 0.6

sources: JVNDB: JVNDB-2023-001110 // CNNVD: CNNVD-202301-1785

EXTERNAL IDS

db:	NVD	id:	CVE-2023-22322	Trust: 2.6
db:	JVN	id:	JVNVU94200979	Trust: 2.6
db:	JVNDB	id:	JVNDB-2023-001110	Trust: 1.4
db:	CNNVD	id:	CNNVD-202301-1785	Trust: 0.6
db:	VULHUB	id:	VHN-449931	Trust: 0.1
db:	VULMON	id:	CVE-2023-22322	Trust: 0.1

sources: VULHUB: VHN-449931 // VULMON: CVE-2023-22322 // JVNDB: JVNDB-2023-001110 // CNNVD: CNNVD-202301-1785 // NVD: CVE-2023-22322

REFERENCES

url:	https://jvn.jp/en/vu/jvnvu94200979/	Trust: 1.8
url:	https://jvn.jp/vu/jvnvu94200979/index.html	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-22322/	Trust: 0.6
url:	https://jvndb.jvn.jp/en/contents/2023/jvndb-2023-001110.html	Trust: 0.6
url:	https://github.com/live-hack-cve/cve-2023-22322	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-449931 // VULMON: CVE-2023-22322 // JVNDB: JVNDB-2023-001110 // CNNVD: CNNVD-202301-1785 // NVD: CVE-2023-22322

SOURCES

db:	VULHUB	id:	VHN-449931
db:	VULMON	id:	CVE-2023-22322
db:	JVNDB	id:	JVNDB-2023-001110
db:	CNNVD	id:	CNNVD-202301-1785
db:	NVD	id:	CVE-2023-22322

LAST UPDATE DATE

2025-03-28T23:29:04.672000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-449931	date:	2023-02-06T00:00:00
db:	VULMON	id:	CVE-2023-22322	date:	2023-01-30T00:00:00
db:	JVNDB	id:	JVNDB-2023-001110	date:	2023-01-25T03:12:00
db:	CNNVD	id:	CNNVD-202301-1785	date:	2023-02-07T00:00:00
db:	NVD	id:	CVE-2023-22322	date:	2025-03-27T21:15:41.690

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-449931	date:	2023-01-30T00:00:00
db:	VULMON	id:	CVE-2023-22322	date:	2023-01-30T00:00:00
db:	JVNDB	id:	JVNDB-2023-001110	date:	2023-01-25T00:00:00
db:	CNNVD	id:	CNNVD-202301-1785	date:	2023-01-24T00:00:00
db:	NVD	id:	CVE-2023-22322	date:	2023-01-30T07:15:09.237