Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities found for Automation Builder by ABB
CVE-2025-3395 (GCVE-0-2025-3395)
Vulnerability from nvd – Published: 2025-04-30 12:40 – Updated: 2025-04-30 13:18
VLAI?
Summary
Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ABB | Automation Builder |
Affected:
0 , ≤ 2.8.0
(custom)
|
Date Public ?
2025-04-30 04:30
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-30T13:17:44.945628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T13:18:13.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Automation Builder",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
}
],
"datePublic": "2025-04-30T04:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
}
],
"value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T12:40:37.562Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2025-3395",
"datePublished": "2025-04-30T12:40:37.562Z",
"dateReserved": "2025-04-07T08:28:05.273Z",
"dateUpdated": "2025-04-30T13:18:13.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3394 (GCVE-0-2025-3394)
Vulnerability from nvd – Published: 2025-04-30 12:34 – Updated: 2025-04-30 13:25
VLAI?
Title
Vulnerability in user management of Automation Builder
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ABB | Automation Builder |
Affected:
0 , ≤ 2.8.0
(custom)
|
Date Public ?
2025-04-30 12:34
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-30T13:22:38.261616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T13:25:28.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Automation Builder",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
}
],
"datePublic": "2025-04-30T12:34:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
}
],
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T12:34:50.577Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability in user management of Automation Builder",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2025-3394",
"datePublished": "2025-04-30T12:34:50.577Z",
"dateReserved": "2025-04-07T08:28:03.573Z",
"dateUpdated": "2025-04-30T13:25:28.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3395 (GCVE-0-2025-3395)
Vulnerability from cvelistv5 – Published: 2025-04-30 12:40 – Updated: 2025-04-30 13:18
VLAI?
Summary
Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ABB | Automation Builder |
Affected:
0 , ≤ 2.8.0
(custom)
|
Date Public ?
2025-04-30 04:30
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-30T13:17:44.945628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T13:18:13.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Automation Builder",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
}
],
"datePublic": "2025-04-30T04:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
}
],
"value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T12:40:37.562Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2025-3395",
"datePublished": "2025-04-30T12:40:37.562Z",
"dateReserved": "2025-04-07T08:28:05.273Z",
"dateUpdated": "2025-04-30T13:18:13.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3394 (GCVE-0-2025-3394)
Vulnerability from cvelistv5 – Published: 2025-04-30 12:34 – Updated: 2025-04-30 13:25
VLAI?
Title
Vulnerability in user management of Automation Builder
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ABB | Automation Builder |
Affected:
0 , ≤ 2.8.0
(custom)
|
Date Public ?
2025-04-30 12:34
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-30T13:22:38.261616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T13:25:28.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Automation Builder",
"vendor": "ABB",
"versions": [
{
"lessThanOrEqual": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
}
],
"datePublic": "2025-04-30T12:34:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
}
],
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T12:34:50.577Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability in user management of Automation Builder",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2025-3394",
"datePublished": "2025-04-30T12:34:50.577Z",
"dateReserved": "2025-04-07T08:28:03.573Z",
"dateUpdated": "2025-04-30T13:25:28.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202206-1272
Vulnerability from variot - Updated: 2024-11-23 22:10Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-1272",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "automation builder",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "1.1.0"
},
{
"model": "mint workbench",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "5866"
},
{
"model": "drive composer",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "2.0"
},
{
"model": "automation builder",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "2.5.0"
},
{
"model": "drive composer",
"scope": "lt",
"trust": 1.0,
"vendor": "abb",
"version": "2.7.1"
},
{
"model": "automation builder",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "mint workbench",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "drive composer",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "automation builder platform",
"scope": null,
"trust": 0.7,
"vendor": "abb",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
}
],
"trust": 0.7
},
"cve": "CVE-2022-31216",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2022-31216",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-422903",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31216",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-31216",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31216",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-31216",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cybersecurity@ch.abb.com",
"id": "CVE-2022-31216",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-31216",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2022-31216",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-1523",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-422903",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2022-31216",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "VULHUB",
"id": "VHN-422903"
},
{
"db": "VULMON",
"id": "CVE-2022-31216"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-31216"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "VULHUB",
"id": "VHN-422903"
},
{
"db": "VULMON",
"id": "CVE-2022-31216"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-31216",
"trust": 4.1
},
{
"db": "ICS CERT",
"id": "ICSA-22-202-01",
"trust": 1.5
},
{
"db": "JVN",
"id": "JVNVU93357079",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16276",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1012",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.3566",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022071810",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1523",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-422903",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-31216",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "VULHUB",
"id": "VHN-422903"
},
{
"db": "VULMON",
"id": "CVE-2022-31216"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"id": "VAR-202206-1272",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-422903"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:10:43.487000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ABB has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/Vulnerabilities_in_Automation_Builder_and_Drive_Composer_and_Mint_WorkBench.pdf?x-sign=Dsvwu1eOxEWGDKECZJMzhUkv4wylDwof6PtNKvY8QFk+nBjFCRKlgeR096xY5FkJ"
},
{
"title": "ABB Drive Composer Post-link vulnerability fixes",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=247273"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-59",
"trust": 1.0
},
{
"problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": "CWE-269",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-422903"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93357079/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31216"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
},
{
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-31216/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
},
{
"trust": 0.1,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/59.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-01"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "VULHUB",
"id": "VHN-422903"
},
{
"db": "VULMON",
"id": "CVE-2022-31216"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"db": "VULHUB",
"id": "VHN-422903"
},
{
"db": "VULMON",
"id": "CVE-2022-31216"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
},
{
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-422903"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31216"
},
{
"date": "2023-08-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"date": "2022-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1523"
},
{
"date": "2022-06-15T19:15:11.367000",
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1012"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULHUB",
"id": "VHN-422903"
},
{
"date": "2023-09-13T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31216"
},
{
"date": "2023-08-24T08:26:00",
"db": "JVNDB",
"id": "JVNDB-2022-011890"
},
{
"date": "2023-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1523"
},
{
"date": "2024-11-21T07:04:09.157000",
"db": "NVD",
"id": "CVE-2022-31216"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011890"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "post link",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1523"
}
],
"trust": 0.6
}
}
VAR-202206-1304
Vulnerability from variot - Updated: 2024-11-23 22:10Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-1304",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "automation builder",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "1.1.0"
},
{
"model": "mint workbench",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "5866"
},
{
"model": "drive composer",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "2.0"
},
{
"model": "automation builder",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "2.5.0"
},
{
"model": "drive composer",
"scope": "lt",
"trust": 1.0,
"vendor": "abb",
"version": "2.7.1"
},
{
"model": "automation builder",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "mint workbench",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "drive composer",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "automation builder platform",
"scope": null,
"trust": 0.7,
"vendor": "abb",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
}
],
"trust": 0.7
},
"cve": "CVE-2022-31217",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2022-31217",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-422904",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31217",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-31217",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31217",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-31217",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cybersecurity@ch.abb.com",
"id": "CVE-2022-31217",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-31217",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2022-31217",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-1522",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-422904",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2022-31217",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "VULHUB",
"id": "VHN-422904"
},
{
"db": "VULMON",
"id": "CVE-2022-31217"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-31217"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "VULHUB",
"id": "VHN-422904"
},
{
"db": "VULMON",
"id": "CVE-2022-31217"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-31217",
"trust": 4.1
},
{
"db": "ICS CERT",
"id": "ICSA-22-202-01",
"trust": 1.4
},
{
"db": "JVN",
"id": "JVNVU93357079",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16277",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1013",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.3566",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022071810",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1522",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-422904",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-31217",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "VULHUB",
"id": "VHN-422904"
},
{
"db": "VULMON",
"id": "CVE-2022-31217"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"id": "VAR-202206-1304",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-422904"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:10:43.452000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ABB has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/Vulnerabilities_in_Automation_Builder_and_Drive_Composer_and_Mint_WorkBench.pdf?x-sign=Dsvwu1eOxEWGDKECZJMzhUkv4wylDwof6PtNKvY8QFk+nBjFCRKlgeR096xY5FkJ"
},
{
"title": "ABB Drive Composer Post-link vulnerability fixes",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=247272"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-59",
"trust": 1.0
},
{
"problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": "CWE-269",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-422904"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93357079/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31217"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
},
{
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-31217/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
},
{
"trust": 0.1,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/269.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "VULHUB",
"id": "VHN-422904"
},
{
"db": "VULMON",
"id": "CVE-2022-31217"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"db": "VULHUB",
"id": "VHN-422904"
},
{
"db": "VULMON",
"id": "CVE-2022-31217"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
},
{
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-422904"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31217"
},
{
"date": "2023-08-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"date": "2022-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1522"
},
{
"date": "2022-06-15T19:15:11.420000",
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1013"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULHUB",
"id": "VHN-422904"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31217"
},
{
"date": "2023-08-24T08:26:00",
"db": "JVNDB",
"id": "JVNDB-2022-011889"
},
{
"date": "2023-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1522"
},
{
"date": "2024-11-21T07:04:09.297000",
"db": "NVD",
"id": "CVE-2022-31217"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011889"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "post link",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1522"
}
],
"trust": 0.6
}
}
VAR-202206-1397
Vulnerability from variot - Updated: 2024-11-23 22:10Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-1397",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "automation builder",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "1.1.0"
},
{
"model": "mint workbench",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "5866"
},
{
"model": "drive composer",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "2.0"
},
{
"model": "automation builder",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "2.5.0"
},
{
"model": "drive composer",
"scope": "lt",
"trust": 1.0,
"vendor": "abb",
"version": "2.7.1"
},
{
"model": "automation builder",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "mint workbench",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "drive composer",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "automation builder platform",
"scope": null,
"trust": 0.7,
"vendor": "abb",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
}
],
"trust": 0.7
},
"cve": "CVE-2022-31218",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2022-31218",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-422905",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31218",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-31218",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31218",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-31218",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cybersecurity@ch.abb.com",
"id": "CVE-2022-31218",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-31218",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2022-31218",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-1521",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-422905",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2022-31218",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "VULHUB",
"id": "VHN-422905"
},
{
"db": "VULMON",
"id": "CVE-2022-31218"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-31218"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "VULHUB",
"id": "VHN-422905"
},
{
"db": "VULMON",
"id": "CVE-2022-31218"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-31218",
"trust": 4.1
},
{
"db": "ICS CERT",
"id": "ICSA-22-202-01",
"trust": 1.4
},
{
"db": "JVN",
"id": "JVNVU93357079",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16281",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1014",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.3566",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022071810",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1521",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-422905",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-31218",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "VULHUB",
"id": "VHN-422905"
},
{
"db": "VULMON",
"id": "CVE-2022-31218"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"id": "VAR-202206-1397",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-422905"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:10:43.390000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ABB has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/Vulnerabilities_in_Automation_Builder_and_Drive_Composer_and_Mint_WorkBench.pdf?x-sign=Dsvwu1eOxEWGDKECZJMzhUkv4wylDwof6PtNKvY8QFk+nBjFCRKlgeR096xY5FkJ"
},
{
"title": "ABB Automation Post-link vulnerability fixes",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=247271"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-59",
"trust": 1.0
},
{
"problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": "CWE-269",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-422905"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93357079/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31218"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
},
{
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-31218/"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
},
{
"trust": 0.1,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/269.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "VULHUB",
"id": "VHN-422905"
},
{
"db": "VULMON",
"id": "CVE-2022-31218"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"db": "VULHUB",
"id": "VHN-422905"
},
{
"db": "VULMON",
"id": "CVE-2022-31218"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
},
{
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-422905"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31218"
},
{
"date": "2023-08-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"date": "2022-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1521"
},
{
"date": "2022-06-15T19:15:11.477000",
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1014"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULHUB",
"id": "VHN-422905"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31218"
},
{
"date": "2023-08-24T08:26:00",
"db": "JVNDB",
"id": "JVNDB-2022-011888"
},
{
"date": "2023-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1521"
},
{
"date": "2024-11-21T07:04:09.430000",
"db": "NVD",
"id": "CVE-2022-31218"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011888"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "post link",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1521"
}
],
"trust": 0.6
}
}
VAR-202206-1305
Vulnerability from variot - Updated: 2024-11-23 22:10Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-1305",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "automation builder",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "1.1.0"
},
{
"model": "mint workbench",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "5866"
},
{
"model": "drive composer",
"scope": "gte",
"trust": 1.0,
"vendor": "abb",
"version": "2.0"
},
{
"model": "automation builder",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "2.5.0"
},
{
"model": "drive composer",
"scope": "lt",
"trust": 1.0,
"vendor": "abb",
"version": "2.7.1"
},
{
"model": "automation builder",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "mint workbench",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "drive composer",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "automation builder platform",
"scope": null,
"trust": 0.7,
"vendor": "abb",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
}
],
"trust": 0.7
},
"cve": "CVE-2022-31219",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2022-31219",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-422906",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-31219",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "cybersecurity@ch.abb.com",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"id": "CVE-2022-31219",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-31219",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"id": "CVE-2022-31219",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-31219",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cybersecurity@ch.abb.com",
"id": "CVE-2022-31219",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-31219",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2022-31219",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-1518",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-422906",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2022-31219",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "VULHUB",
"id": "VHN-422906"
},
{
"db": "VULMON",
"id": "CVE-2022-31219"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-31219"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "VULHUB",
"id": "VHN-422906"
},
{
"db": "VULMON",
"id": "CVE-2022-31219"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-31219",
"trust": 4.1
},
{
"db": "ICS CERT",
"id": "ICSA-22-202-01",
"trust": 1.5
},
{
"db": "JVN",
"id": "JVNVU93357079",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-16321",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1015",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2022.3566",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022071810",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1518",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-422906",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-31219",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "VULHUB",
"id": "VHN-422906"
},
{
"db": "VULMON",
"id": "CVE-2022-31219"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"id": "VAR-202206-1305",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-422906"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:10:43.357000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ABB has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/Vulnerabilities_in_Automation_Builder_and_Drive_Composer_and_Mint_WorkBench.pdf?x-sign=Dsvwu1eOxEWGDKECZJMzhUkv4wylDwof6PtNKvY8QFk+nBjFCRKlgeR096xY5FkJ"
},
{
"title": "ABB Mint WorkBench Post-link vulnerability fixes",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=247270"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-59",
"trust": 1.0
},
{
"problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
"trust": 0.8
},
{
"problemtype": "CWE-269",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-422906"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93357079/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-31219"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
},
{
"trust": 0.7,
"url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-31219/"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
},
{
"trust": 0.1,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/269.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-01"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "VULHUB",
"id": "VHN-422906"
},
{
"db": "VULMON",
"id": "CVE-2022-31219"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"db": "VULHUB",
"id": "VHN-422906"
},
{
"db": "VULMON",
"id": "CVE-2022-31219"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
},
{
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULHUB",
"id": "VHN-422906"
},
{
"date": "2022-06-15T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31219"
},
{
"date": "2023-08-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"date": "2022-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1518"
},
{
"date": "2022-06-15T19:15:11.530000",
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1015"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULHUB",
"id": "VHN-422906"
},
{
"date": "2022-06-24T00:00:00",
"db": "VULMON",
"id": "CVE-2022-31219"
},
{
"date": "2023-08-24T08:26:00",
"db": "JVNDB",
"id": "JVNDB-2022-011887"
},
{
"date": "2023-07-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-1518"
},
{
"date": "2024-11-21T07:04:09.570000",
"db": "NVD",
"id": "CVE-2022-31219"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011887"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "post link",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-1518"
}
],
"trust": 0.6
}
}