cvelistv5 - cve-2022-22141

cve-2022-22141

Vulnerability from cvelistv5

Published

2022-03-11 09:10

Modified

2024-08-03 03:07

Severity ?

Summary

'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

References

▼	URL	Tags
	vultures@jpcert.or.jp	https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf	Vendor Advisory

Impacted products

▼	Vendor	Product
	Yokogawa Electric Corporation	CENTUM CS 3000
	Yokogawa Electric Corporation	CENTUM VP
	Yokogawa Electric Corporation	Exaopc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:07:48.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CENTUM CS 3000",
          "vendor": "Yokogawa Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions from R3.08.10 to R3.09.00"
            }
          ]
        },
        {
          "product": "CENTUM VP",
          "vendor": "Yokogawa Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions from R4.01.00 to R4.03.00"
            },
            {
              "status": "affected",
              "version": "versions from R5.01.00 to R5.04.20"
            },
            {
              "status": "affected",
              "version": "versions from R6.01.00 to R6.08.00"
            }
          ]
        },
        {
          "product": "Exaopc",
          "vendor": "Yokogawa Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions from R3.72.00 to R3.79.00"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u0027Long-term Data Archive Package\u0027 service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-11T09:10:43",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-22141",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CENTUM CS 3000",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from R3.08.10 to R3.09.00"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CENTUM VP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from R4.01.00 to R4.03.00"
                          },
                          {
                            "version_value": "versions from R5.01.00 to R5.04.20"
                          },
                          {
                            "version_value": "versions from R6.01.00 to R6.08.00"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Exaopc",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from R3.72.00 to R3.79.00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yokogawa Electric Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "\u0027Long-term Data Archive Package\u0027 service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-732: Incorrect Permission Assignment for Critical Resource"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf",
              "refsource": "CONFIRM",
              "url": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-22141",
    "datePublished": "2022-03-11T09:10:44",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2024-08-03T03:07:48.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-22141\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2022-03-11T09:15:11.460\",\"lastModified\":\"2022-03-18T15:14:17.510\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"\u0027Long-term Data Archive Package\u0027 service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.\"},{\"lang\":\"es\",\"value\":\"El servicio \\\"Long-term Data Archive Package\\\" implementado en los siguientes productos de Yokogawa Electric crea algunas tuber\u00edas con nombre con una configuraci\u00f3n inapropiada de ACL. CENTUM CS 3000 versiones desde R3.08.10 a R3.09.00, CENTUM VP versiones desde R4.01.00 a R4.03.00, desde R5.01.00 a R5.04.20, y desde R6.01.00 a R6.08.00, Exaopc versiones desde R3.72.00 a R3.79.00\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:P/I:P/A:P\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":4.4},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]},{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r3.08.10\",\"versionEndIncluding\":\"r3.09.00\",\"matchCriteriaId\":\"9D7B6EFE-A886-4409-BE19-E67C0057265B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAF123F6-D4A3-49B3-B8BC-14AA63E3A46A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_cs_3000_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r3.08.10\",\"versionEndIncluding\":\"r3.09.00\",\"matchCriteriaId\":\"CBD66947-E8ED-45FC-8A71-14D4CB8D7368\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_cs_3000_entry:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67BFCAD6-7540-4279-92C5-9ADAB35CD4A7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r4.01.00\",\"versionEndIncluding\":\"r4.03.00\",\"matchCriteriaId\":\"D0D63842-D6A8-4FA1-B09C-71E9113FF95A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r5.01.00\",\"versionEndIncluding\":\"r5.04.20\",\"matchCriteriaId\":\"D647BA49-5A43-437B-8C58-0294A452AF8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r6.01.00\",\"versionEndExcluding\":\"r6.09.00\",\"matchCriteriaId\":\"01914A03-6248-4183-94FE-64902B0D1DDF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"161A4767-228C-4681-9D20-81D9380CE48A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r4.01.00\",\"versionEndIncluding\":\"r4.03.00\",\"matchCriteriaId\":\"1CDBFA61-421D-484C-B33E-938CD58BDCEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r5.01.00\",\"versionEndIncluding\":\"r5.04.20\",\"matchCriteriaId\":\"B25462B1-4031-4FAB-8C67-CF060BE472B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r6.01.00\",\"versionEndExcluding\":\"r6.09.00\",\"matchCriteriaId\":\"27CBFAD9-1DD0-4B18-B8F6-6EB8F6396556\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_vp_entry:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E37ECBA-48F6-456A-AE49-83347A91208B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r3.72.00\",\"versionEndExcluding\":\"r3.80.00\",\"matchCriteriaId\":\"4D5233E5-DABF-4CCE-A92F-F437DECFBCB9\"}]}]}],\"references\":[{\"url\":\"https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2022-22141

Vulnerability from cvelistv5

ghsa-vgx2-4rfg-qw47

Vulnerability from github

var-202203-0853

Vulnerability from variot

gsd-2022-22141

Vulnerability from gsd

Tags

Sightings

Nomenclature