CVE-2022-22732 Information disclosure in EcoStruxure Power Commission
Remote attackers can access server resources via fetch requests from third-party sites, exposing sensitive data in EcoStruxure Power Commission.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-22732?
CVE-2022-22732 is a low-severity vulnerability in Schneider Electric EcoStruxure Power Commission, published on 30 Jan 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)
Weakness: CWE-668
Which versions are affected by CVE-2022-22732?
It affects 1 product.
Products include Schneider-Electric Ecostruxure Power Commission.
How do I fix CVE-2022-22732?
No fix has been published for CVE-2022-22732 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-22732 being exploited?
There is no known exploitation of CVE-2022-22732 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric EcoStruxure Power Commission
Sources
Also known as GHSA-5w35-cmj6-vc9r.