CVE-2023-46290 (GCVE-0-2023-46290)

Vulnerability from cvelistv5 – Published: 2023-10-27 18:10 – Updated: 2025-02-27 20:39
VLAI?
Summary
Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk® Services Platform web service.
Severity ?
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-287 - Improper Authentication
Assigner
References
Impacted products
Vendor Product Version
Rockwell Automation FactoryTalk® Services Platform Affected: versions before 2.80
Create a notification for this product.
Credits
This vulnerability was found internally during routine testing.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:45:40.833Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T21:49:21.323063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T20:39:11.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FactoryTalk\u00ae Services Platform",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "versions before 2.80"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": " This vulnerability was found internally during routine testing."
        }
      ],
      "datePublic": "2023-10-26T13:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDue to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk\u00ae Services Platform web service and then use the token to log in into FactoryTalk\u00ae Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk\u00ae Services Platform web service.\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nDue to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk\u00ae Services Platform web service and then use the token to log in into FactoryTalk\u00ae Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk\u00ae Services Platform web service.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-633",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-633 Token Impersonation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-27T18:10:50.923Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cul\u003e\u003cli\u003eInstall the respective \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://compatibility.rockwellautomation.com/Pages/MultiProductCompareSelections.aspx?crumb=113\u0026amp;versions=61602,60883,59837,59480,58564,57413,58591,59481,59482,59483,59484,59485,59486,59487,59488,59490,59491,59492,59493,59494,59495,59496\"\u003eFactoryTalk Services Version\u003c/a\u003e\u0026nbsp;that remediates the issue.\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012\"\u003eQA43240 - Recommended Security Guidelines from Rockwell Automation\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\n  *  Install the respective  FactoryTalk Services Version https://compatibility.rockwellautomation.com/Pages/MultiProductCompareSelections.aspx \u00a0that remediates the issue.\n  *   QA43240 - Recommended Security Guidelines from Rockwell Automation https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012 \n\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Rockwell Automation FactoryTalk Services Platform Elevated Privileges Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2023-46290",
    "datePublished": "2023-10-27T18:10:50.923Z",
    "dateReserved": "2023-10-20T18:01:46.095Z",
    "dateUpdated": "2025-02-27T20:39:11.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.80\", \"matchCriteriaId\": \"86F8AE4A-2067-4989-BED5-B4CB8A03E8BB\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\nDue to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk\\u00ae Services Platform web service and then use the token to log in into FactoryTalk\\u00ae Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk\\u00ae Services Platform web service.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Debido a una l\\u00f3gica de c\\u00f3digo inadecuada, un actor de amenazas no autenticado previamente podr\\u00eda obtener un token de usuario del sistema operativo Windows local a trav\\u00e9s del servicio web FactoryTalk\\u00ae Services Platform y luego usar el token para iniciar sesi\\u00f3n en FactoryTalk\\u00ae Services Platform. Esta vulnerabilidad solo se puede aprovechar si el usuario autorizado no inici\\u00f3 sesi\\u00f3n previamente en el servicio web FactoryTalk\\u00ae Services Platform.\"}]",
      "id": "CVE-2023-46290",
      "lastModified": "2024-11-21T08:28:14.440",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"PSIRT@rockwellautomation.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}]}",
      "published": "2023-10-27T19:15:41.560",
      "references": "[{\"url\": \"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165\", \"source\": \"PSIRT@rockwellautomation.com\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}, {\"url\": \"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "PSIRT@rockwellautomation.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"PSIRT@rockwellautomation.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-46290\",\"sourceIdentifier\":\"PSIRT@rockwellautomation.com\",\"published\":\"2023-10-27T19:15:41.560\",\"lastModified\":\"2024-11-21T08:28:14.440\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\nDue to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk\u00ae Services Platform web service and then use the token to log in into FactoryTalk\u00ae Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk\u00ae Services Platform web service.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Debido a una l\u00f3gica de c\u00f3digo inadecuada, un actor de amenazas no autenticado previamente podr\u00eda obtener un token de usuario del sistema operativo Windows local a trav\u00e9s del servicio web FactoryTalk\u00ae Services Platform y luego usar el token para iniciar sesi\u00f3n en FactoryTalk\u00ae Services Platform. Esta vulnerabilidad solo se puede aprovechar si el usuario autorizado no inici\u00f3 sesi\u00f3n previamente en el servicio web FactoryTalk\u00ae Services Platform.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"PSIRT@rockwellautomation.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"PSIRT@rockwellautomation.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.80\",\"matchCriteriaId\":\"86F8AE4A-2067-4989-BED5-B4CB8A03E8BB\"}]}]}],\"references\":[{\"url\":\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165\",\"source\":\"PSIRT@rockwellautomation.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"FactoryTalk\\u00ae Services Platform\", \"vendor\": \"Rockwell Automation\", \"versions\": [{\"status\": \"affected\", \"version\": \"versions before 2.80\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \" This vulnerability was found internally during routine testing.\"}], \"datePublic\": \"2023-10-26T13:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eDue to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk\\u00ae Services Platform web service and then use the token to log in into FactoryTalk\\u00ae Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk\\u00ae Services Platform web service.\u003c/span\u003e\\n\\n\"}], \"value\": \"\\nDue to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk\\u00ae Services Platform web service and then use the token to log in into FactoryTalk\\u00ae Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk\\u00ae Services Platform web service.\\n\\n\"}], \"impacts\": [{\"capecId\": \"CAPEC-633\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-633 Token Impersonation\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-287\", \"description\": \"CWE-287 Improper Authentication\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"b73dd486-f505-4403-b634-40b078b177f0\", \"shortName\": \"Rockwell\", \"dateUpdated\": \"2023-10-27T18:10:50.923Z\"}, \"references\": [{\"url\": \"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\\n\\n\u003cul\u003e\u003cli\u003eInstall the respective \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://compatibility.rockwellautomation.com/Pages/MultiProductCompareSelections.aspx?crumb=113\u0026amp;versions=61602,60883,59837,59480,58564,57413,58591,59481,59482,59483,59484,59485,59486,59487,59488,59490,59491,59492,59493,59494,59495,59496\\\"\u003eFactoryTalk Services Version\u003c/a\u003e\u0026nbsp;that remediates the issue.\u003c/li\u003e\u003cli\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012\\\"\u003eQA43240 - Recommended Security Guidelines from Rockwell Automation\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\\n\\n\u003cbr\u003e\"}], \"value\": \"\\n  *  Install the respective  FactoryTalk Services Version https://compatibility.rockwellautomation.com/Pages/MultiProductCompareSelections.aspx \\u00a0that remediates the issue.\\n  *   QA43240 - Recommended Security Guidelines from Rockwell Automation https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012 \\n\\n\\n\\n\\n\\n\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Rockwell Automation FactoryTalk Services Platform Elevated Privileges Vulnerability\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T20:45:40.833Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-46290\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-26T21:49:21.323063Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-26T19:57:01.776Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-46290\", \"assignerOrgId\": \"b73dd486-f505-4403-b634-40b078b177f0\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Rockwell\", \"dateReserved\": \"2023-10-20T18:01:46.095Z\", \"datePublished\": \"2023-10-27T18:10:50.923Z\", \"dateUpdated\": \"2025-02-27T20:39:11.981Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.