CVE-2022-35890

Опубликовано: 15 июл. 2022

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy.

Ссылки

https://github.com/sourceincite/randy
Exploit
Third Party Advisory
https://support.inductiveautomation.com/hc/en-us/articles/7625759776653
Vendor Advisory
https://github.com/sourceincite/randy
Exploit
Third Party Advisory
https://support.inductiveautomation.com/hc/en-us/articles/7625759776653
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:*

Версия до 7.9.20 (исключая)

cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:*

Версия от 8.0.1 (включая) до 8.1.17 (исключая)

EPSS

Процентиль: 76%

0.00985

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-863

Связанные уязвимости

GHSA-v987-5jrj-j3xx