9.8
CVE-2022-35890
- EPSS 0.99%
- Veröffentlicht 15.07.2022 21:15:08
- Zuletzt bearbeitet 21.11.2024 07:11:53
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginAn issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Inductiveautomation ≫ Ignition Version < 7.9.20
Inductiveautomation ≫ Ignition Version >= 8.0.1 < 8.1.17
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.99% | 0.761 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.