Details of VAR-202211-0309

ID

VAR-202211-0309

CVE

CVE-2022-41663

TITLE

Siemens' JT2Go and Teamcenter Visualization Vulnerability in using free memory in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022823

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process. Siemens' JT2Go and Teamcenter Visualization Exists in a vulnerability related to the use of freed memory.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2022-41663 // JVNDB: JVNDB-2022-022823

AFFECTED PRODUCTS

vendor:	siemens	model:	jt2go	scope:	lt	version:	14.1.0.4	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.3.0.7	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.4	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	13.3.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.0.0.3	Trust: 1.0
vendor:	シーメンス	model:	teamcenter visualization	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-022823 // NVD: CVE-2022-41663

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-41663
value:	HIGH
Trust: 1.8
productcert@siemens.com:	CVE-2022-41663
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202211-2314
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2022-41663
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-022823 // NVD: CVE-2022-41663 // NVD: CVE-2022-41663 // CNNVD: CNNVD-202211-2314

PROBLEMTYPE DATA

problemtype:	CWE-416	Trust: 1.0
problemtype:	Use of freed memory (CWE-416) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-022823 // NVD: CVE-2022-41663

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202211-2314

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202211-2314

CONFIGURATIONS

sources: NVD: CVE-2022-41663

PATCH

title:

Siemens JT2Go and Teamcenter Remediation of resource management error vulnerabilities

url:

http://123.124.177.30/web/xxk/bdxqbyid.tag?id=213368

Trust: 0.6

sources: CNNVD: CNNVD-202211-2314

EXTERNAL IDS

db:	NVD	id:	CVE-2022-41663	Trust: 3.2
db:	SIEMENS	id:	SSA-120378	Trust: 2.4
db:	ICS CERT	id:	ICSA-22-314-09	Trust: 0.8
db:	JVN	id:	JVNVU93762879	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-022823	Trust: 0.8
db:	CNNVD	id:	CNNVD-202211-2314	Trust: 0.6

sources: JVNDB: JVNDB-2022-022823 // NVD: CVE-2022-41663 // CNNVD: CNNVD-202211-2314

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf	Trust: 2.4
url:	https://jvn.jp/vu/jvnvu93762879/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-41663	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-22-314-09	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-41663/	Trust: 0.6

sources: JVNDB: JVNDB-2022-022823 // NVD: CVE-2022-41663 // CNNVD: CNNVD-202211-2314

SOURCES

db:	JVNDB	id:	JVNDB-2022-022823
db:	NVD	id:	CVE-2022-41663
db:	CNNVD	id:	CNNVD-202211-2314

LAST UPDATE DATE

2023-12-18T10:53:12.291000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-022823	date:	2023-11-21T01:47:00
db:	NVD	id:	CVE-2022-41663	date:	2023-06-13T09:15:15.243
db:	CNNVD	id:	CNNVD-202211-2314	date:	2023-06-14T00:00:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-022823	date:	2023-11-21T00:00:00
db:	NVD	id:	CVE-2022-41663	date:	2022-11-08T11:15:11.753
db:	CNNVD	id:	CNNVD-202211-2314	date:	2022-11-08T00:00:00