Search criteria

8 vulnerabilities found for Automation Builder by ABB

CVE-2025-3395 (GCVE-0-2025-3395)

Vulnerability from cvelistv5 – Published: 2025-04-30 12:40 – Updated: 2025-04-30 13:18
VLAI?
Summary
Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
8.4 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
ABB
References
Impacted products
Vendor Product Version
ABB Automation Builder Affected: 0 , ≤ 2.8.0 (custom)
Create a notification for this product.
Credits
ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3395",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T13:17:44.945628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-30T13:18:13.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Automation Builder",
          "vendor": "ABB",
          "versions": [
            {
              "lessThanOrEqual": "2.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
        }
      ],
      "datePublic": "2025-04-30T04:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T12:40:37.562Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2025-3395",
    "datePublished": "2025-04-30T12:40:37.562Z",
    "dateReserved": "2025-04-07T08:28:05.273Z",
    "dateUpdated": "2025-04-30T13:18:13.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-3394 (GCVE-0-2025-3394)

Vulnerability from cvelistv5 – Published: 2025-04-30 12:34 – Updated: 2025-04-30 13:25
VLAI?
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
8.5 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
ABB
References
Impacted products
Vendor Product Version
ABB Automation Builder Affected: 0 , ≤ 2.8.0 (custom)
Create a notification for this product.
Credits
ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T13:22:38.261616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-30T13:25:28.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Automation Builder",
          "vendor": "ABB",
          "versions": [
            {
              "lessThanOrEqual": "2.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
        }
      ],
      "datePublic": "2025-04-30T12:34:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T12:34:50.577Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability in user management of Automation Builder",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2025-3394",
    "datePublished": "2025-04-30T12:34:50.577Z",
    "dateReserved": "2025-04-07T08:28:03.573Z",
    "dateUpdated": "2025-04-30T13:25:28.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-3395 (GCVE-0-2025-3395)

Vulnerability from nvd – Published: 2025-04-30 12:40 – Updated: 2025-04-30 13:18
VLAI?
Summary
Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
8.4 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
  • CWE-312 - Cleartext Storage of Sensitive Information
Assigner
ABB
References
Impacted products
Vendor Product Version
ABB Automation Builder Affected: 0 , ≤ 2.8.0 (custom)
Create a notification for this product.
Credits
ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3395",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T13:17:44.945628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-30T13:18:13.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Automation Builder",
          "vendor": "ABB",
          "versions": [
            {
              "lessThanOrEqual": "2.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
        }
      ],
      "datePublic": "2025-04-30T04:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T12:40:37.562Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2025-3395",
    "datePublished": "2025-04-30T12:40:37.562Z",
    "dateReserved": "2025-04-07T08:28:05.273Z",
    "dateUpdated": "2025-04-30T13:18:13.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-3394 (GCVE-0-2025-3394)

Vulnerability from nvd – Published: 2025-04-30 12:34 – Updated: 2025-04-30 13:25
VLAI?
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.
Severity ?
8.5 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
ABB
References
Impacted products
Vendor Product Version
ABB Automation Builder Affected: 0 , ≤ 2.8.0 (custom)
Create a notification for this product.
Credits
ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T13:22:38.261616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-30T13:25:28.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Automation Builder",
          "vendor": "ABB",
          "versions": [
            {
              "lessThanOrEqual": "2.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ABB acknowledges and extends gratitude to Jiho Shin from Sungkyunkwan University for responsibly disclosing the vulnerability and providing valuable input on product improvements."
        }
      ],
      "datePublic": "2025-04-30T12:34:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.\u003cp\u003eThis issue affects Automation Builder: through 2.8.0.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T12:34:50.577Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability in user management of Automation Builder",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2025-3394",
    "datePublished": "2025-04-30T12:34:50.577Z",
    "dateReserved": "2025-04-07T08:28:03.573Z",
    "dateUpdated": "2025-04-30T13:25:28.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

VAR-202206-1272

Vulnerability from variot - Updated: 2024-02-16 22:38

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202206-1272",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "automation builder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "1.1.0"
      },
      {
        "model": "automation builder",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.5.0"
      },
      {
        "model": "drive composer",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.0"
      },
      {
        "model": "drive composer",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.7.1"
      },
      {
        "model": "mint workbench",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "5866"
      },
      {
        "model": "automation builder",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "mint workbench",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "drive composer",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "automation builder platform",
        "scope": null,
        "trust": 0.7,
        "vendor": "abb",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:abb:mint_workbench:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5866",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:automation_builder:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.5.0",
                "versionStartIncluding": "1.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:pro:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:entry:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2022-31216",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.2,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2022-31216",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-422903",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-31216",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2022-31216",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "NONE",
            "vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-31216",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "cybersecurity@ch.abb.com",
            "id": "CVE-2022-31216",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "ZDI",
            "id": "CVE-2022-31216",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202206-1523",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-422903",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-31216",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31216"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31216"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-31216",
        "trust": 4.1
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-202-01",
        "trust": 1.5
      },
      {
        "db": "JVN",
        "id": "JVNVU93357079",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16276",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1012",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.3566",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022071810",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-422903",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31216",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31216"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "id": "VAR-202206-1272",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-02-16T22:38:43.560000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "ABB has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "title": "ABB Drive Composer Post-link vulnerability fixes",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=247273"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-59",
        "trust": 1.0
      },
      {
        "problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
        "trust": 0.8
      },
      {
        "problemtype": "CWE-269",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu93357079/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-31216"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
      },
      {
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-31216/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
      },
      {
        "trust": 0.1,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/59.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-01"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31216"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31216"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31216"
      },
      {
        "date": "2023-08-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      },
      {
        "date": "2022-06-15T19:15:11.367000",
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1012"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422903"
      },
      {
        "date": "2023-09-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31216"
      },
      {
        "date": "2023-08-24T08:26:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      },
      {
        "date": "2023-07-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      },
      {
        "date": "2024-02-15T21:22:59",
        "db": "NVD",
        "id": "CVE-2022-31216"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011890"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "post link",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1523"
      }
    ],
    "trust": 0.6
  }
}

VAR-202206-1397

Vulnerability from variot - Updated: 2023-12-18 12:34

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202206-1397",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "drive composer",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.7.1"
      },
      {
        "model": "mint workbench",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "5866"
      },
      {
        "model": "automation builder",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.5.0"
      },
      {
        "model": "drive composer",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.0"
      },
      {
        "model": "automation builder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "1.1.0"
      },
      {
        "model": "automation builder",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "mint workbench",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "drive composer",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "automation builder platform",
        "scope": null,
        "trust": 0.7,
        "vendor": "abb",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:abb:mint_workbench:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5866",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:automation_builder:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.5.0",
                "versionStartIncluding": "1.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:pro:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:entry:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2022-31218",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.2,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2022-31218",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-422905",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-31218",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2022-31218",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "NONE",
            "vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-31218",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "cybersecurity@ch.abb.com",
            "id": "CVE-2022-31218",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "ZDI",
            "id": "CVE-2022-31218",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202206-1521",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-422905",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-31218",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31218"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-31218",
        "trust": 4.1
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-202-01",
        "trust": 1.4
      },
      {
        "db": "JVN",
        "id": "JVNVU93357079",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16281",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1014",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.3566",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022071810",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-422905",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31218",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "id": "VAR-202206-1397",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:34:23.570000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "ABB has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "title": "ABB Automation Post-link vulnerability fixes",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=247271"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-59",
        "trust": 1.0
      },
      {
        "problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
        "trust": 0.8
      },
      {
        "problemtype": "CWE-269",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu93357079/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-31218"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
      },
      {
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-31218/"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
      },
      {
        "trust": 0.1,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/269.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31218"
      },
      {
        "date": "2023-08-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "date": "2022-06-15T19:15:11.477000",
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1014"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422905"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31218"
      },
      {
        "date": "2023-08-24T08:26:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      },
      {
        "date": "2023-09-13T04:15:10.513000",
        "db": "NVD",
        "id": "CVE-2022-31218"
      },
      {
        "date": "2023-07-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011888"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "post link",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1521"
      }
    ],
    "trust": 0.6
  }
}

VAR-202206-1304

Vulnerability from variot - Updated: 2023-12-18 12:34

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202206-1304",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "drive composer",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.7.1"
      },
      {
        "model": "mint workbench",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "5866"
      },
      {
        "model": "automation builder",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.5.0"
      },
      {
        "model": "drive composer",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.0"
      },
      {
        "model": "automation builder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "1.1.0"
      },
      {
        "model": "automation builder",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "mint workbench",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "drive composer",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "automation builder platform",
        "scope": null,
        "trust": 0.7,
        "vendor": "abb",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:abb:mint_workbench:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5866",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:automation_builder:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.5.0",
                "versionStartIncluding": "1.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:pro:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:entry:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2022-31217",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.2,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2022-31217",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-422904",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-31217",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2022-31217",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "NONE",
            "vectorString": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-31217",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "cybersecurity@ch.abb.com",
            "id": "CVE-2022-31217",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "ZDI",
            "id": "CVE-2022-31217",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202206-1522",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-422904",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-31217",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31217"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31217"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-31217",
        "trust": 4.1
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-202-01",
        "trust": 1.4
      },
      {
        "db": "JVN",
        "id": "JVNVU93357079",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16277",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1013",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.3566",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022071810",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-422904",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31217",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31217"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "id": "VAR-202206-1304",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:34:23.604000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "ABB has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "title": "ABB Drive Composer Post-link vulnerability fixes",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=247272"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-59",
        "trust": 1.0
      },
      {
        "problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
        "trust": 0.8
      },
      {
        "problemtype": "CWE-269",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu93357079/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-31217"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
      },
      {
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-31217/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
      },
      {
        "trust": 0.1,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/269.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31217"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31217"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31217"
      },
      {
        "date": "2023-08-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "date": "2022-06-15T19:15:11.420000",
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1013"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422904"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31217"
      },
      {
        "date": "2023-08-24T08:26:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      },
      {
        "date": "2023-09-13T04:15:10.403000",
        "db": "NVD",
        "id": "CVE-2022-31217"
      },
      {
        "date": "2023-07-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011889"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "post link",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1522"
      }
    ],
    "trust": 0.6
  }
}

VAR-202206-1305

Vulnerability from variot - Updated: 2023-12-18 12:34

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202206-1305",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "drive composer",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.7.1"
      },
      {
        "model": "mint workbench",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "5866"
      },
      {
        "model": "automation builder",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.5.0"
      },
      {
        "model": "drive composer",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "2.0"
      },
      {
        "model": "automation builder",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "1.1.0"
      },
      {
        "model": "automation builder",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "mint workbench",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "drive composer",
        "scope": null,
        "trust": 0.8,
        "vendor": "abb",
        "version": null
      },
      {
        "model": "automation builder platform",
        "scope": null,
        "trust": 0.7,
        "vendor": "abb",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:abb:mint_workbench:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5866",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:automation_builder:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.5.0",
                "versionStartIncluding": "1.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:pro:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:abb:drive_composer:*:*:*:*:entry:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2022-31219",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.2,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2022-31219",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-422906",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "cybersecurity@ch.abb.com",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.3,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-31219",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.3,
            "id": "CVE-2022-31219",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "REQUIRED",
            "vectorString": "AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-31219",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "cybersecurity@ch.abb.com",
            "id": "CVE-2022-31219",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "ZDI",
            "id": "CVE-2022-31219",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202206-1518",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-422906",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-31219",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31219"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a \"repair\" operation on the product. ABB of automation builder , Drive composer , mint workbench Exists in a link interpretation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Drive Composer installer. By creating a symbolic link, an attacker can abuse the installer to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31219"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-31219",
        "trust": 4.1
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-202-01",
        "trust": 1.5
      },
      {
        "db": "JVN",
        "id": "JVNVU93357079",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16321",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-1015",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.3566",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022071810",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-422906",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31219",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31219"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "id": "VAR-202206-1305",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:34:23.537000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "ABB has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "title": "ABB Mint WorkBench Post-link vulnerability fixes",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=247270"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-59",
        "trust": 1.0
      },
      {
        "problemtype": "Link interpretation problem (CWE-59) [NVD evaluation ]",
        "trust": 0.8
      },
      {
        "problemtype": "CWE-269",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026languagecode=en\u0026documentpartid=\u0026action=launch\u0026_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu93357079/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-31219"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-01"
      },
      {
        "trust": 0.7,
        "url": "https://library.e.abb.com/public/0bc9ed3188ff43be94f2cbdc1751a72d/vulnerabilities_in_automation_builder_and_drive_composer_and_mint_workbench.pdf?x-sign=dsvwu1eoxewgdkeczjmzhukv4wyldwof6ptnkvy8qfk+nbjfcrklger096xy5fkj"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-31219/"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-202-01"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022071810"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.3566"
      },
      {
        "trust": 0.1,
        "url": "https://search.abb.com/library/download.aspx?documentid=9akk108467a0305\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch\u0026amp;_ga=2.38192870.478847987.1655218701-372504397.1647012599"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/269.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-01"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31219"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-31219"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31219"
      },
      {
        "date": "2023-08-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "date": "2022-06-15T19:15:11.530000",
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "date": "2022-06-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-1015"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-422906"
      },
      {
        "date": "2022-06-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-31219"
      },
      {
        "date": "2023-08-24T08:26:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      },
      {
        "date": "2023-09-13T04:15:10.627000",
        "db": "NVD",
        "id": "CVE-2022-31219"
      },
      {
        "date": "2023-07-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural \u00a0ABB\u00a0 Product Link Interpretation Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-011887"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "post link",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202206-1518"
      }
    ],
    "trust": 0.6
  }
}