CVE-2022-38743
Last modified
CVE-2022-38743 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. EPSS estimates a 1.27% chance of exploitation in the next 30 days.
Description
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rockwellautomation | Factorytalk Vantagepoint | 8.0 |
| Rockwellautomation | Factorytalk Vantagepoint | 8.10 |
| Rockwellautomation | Factorytalk Vantagepoint | 8.20 |
| Rockwellautomation | Factorytalk Vantagepoint | 8.30 |
| Rockwellautomation | Factorytalk Vantagepoint | 8.31 |
References
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043Permissions Required, Vendor Advisory
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043Permissions Required, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-38743?
How severe is CVE-2022-38743?
How do I fix CVE-2022-38743?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38738Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-38739Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-3874A command injection flaw was found in foreman. This flaw all…9.1
- CVE-2022-38740Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-38741Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-38742Rockwell Automation ThinManager ThinServer versions 11.0.0 -…9.8
- CVE-2022-38744 An unauthenticated attacker with network access to a victim…7.5
- CVE-2022-38745Apache OpenOffice versions before 4.1.14 may be configured t…7.8
- CVE-2022-38749Using snakeYAML to parse untrusted YAML files may be vulnera…6.5
- CVE-2022-3875A vulnerability classified as critical was found in Click St…7.5
- CVE-2022-38750Using snakeYAML to parse untrusted YAML files may be vulnera…5.5
- CVE-2022-38751Using snakeYAML to parse untrusted YAML files may be vulnera…6.5
Are you affected by CVE-2022-38743?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST