CVE-2022-1704 Inductive Automation Ignition

What is CVE-2022-1704?

CVE-2022-1704 is a high-severity vulnerability in Inductive Automation Ignition, published on 5 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.

Weakness: CWE-611

Which versions are affected by CVE-2022-1704?

It affects 1 product.

Products include Inductiveautomation Ignition.

How do I fix CVE-2022-1704?

No fix has been published for CVE-2022-1704 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-1704 being exploited?

There is no known exploitation of CVE-2022-1704 in the wild and no public exploit code.

Other vulnerabilities in Inductive Automation Ignition

• CVE-2023-39475 Deserialization in Ignition Critical 9.8
• CVE-2023-39476 Deserialization in Ignition Critical 9.8
• CVE-2022-35890 Auth bypass in n/a Critical 9.8
• CVE-2023-39473 Deserialization in Ignition High 8.8
• CVE-2023-50218 Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wj9q-g585-77cq.