CVE-2022-35873 — Product UI does not Warn User of Unsafe Actions in Automation Ignition

CWE-356 — Product UI does not Warn User of Unsafe Actions3 documents3 sources

Severity

7.8HIGHNVD

EPSS

0.5%

top 34.19%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Inductive Automation Ignition Inductiveautomation Ignition

Timeline

PublishedJul 25

Latest updateJul 26

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of ZIP files. Crafted data in a ZIP file can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the ha…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDinductiveautomation/ignition8.1.15

▶CVEListV5inductive_automation/ignition8.1.15 (b2022030114)

🔴Vulnerability Details

GHSA

GHSA-6hm7-67pg-crfx: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8↗2022-07-26

▶

CVEList

CVE-2022-35873: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8↗2022-07-25

▶