CVE-2022-0221

Published: Apr 13, 2022Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)

Affected (1)

Products: Schneider Electric: Scadapack Workbench

Schneider Electric

1 product

Scadapack Workbench

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Scadapack Workbench	Up to 6.6.8a

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://www.se.com/ww/en/download/document/SEVD-2022-087-01/

Source: cybersecurity@se.com

MitigationVendor Advisory

https://www.se.com/ww/en/download/document/SEVD-2022-087-01/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.