« Volver al listado

CVE-2022-38743

Estado: ModificadaAlta (8.8)—

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rockwellautomation — Factorytalk Vantagepoint

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-38743",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-38743",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-13T14:08:34.985497Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT@rockwellautomation.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "FactoryTalk VantagePoint",
          "versions": [
            {
              "status": "affected",
              "version": "8.0, 8.10, 8.20, 8.30, 8.31"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-17T21:15:10.343",
  "references": [
    {
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "PSIRT@rockwellautomation.com"
    },
    {
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "PSIRT@rockwellautomation.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data."
    },
    {
      "lang": "es",
      "value": "Rockwell Automation FactoryTalk VantagePoint versiones 8.0, 8.10, 8.20, 8.30, 8.31, son susceptibles a una vulnerabilidad de control de acceso inapropiada. La cuenta de FactoryTalk VantagePoint SQL Server podría permitir a un usuario malicioso con privilegios de sólo lectura ejecutar sentencias SQL en la base de datos del back-end. Si es explotado con éxito, esto podría permitir al atacante ejecutar código arbitrario y conseguir acceso a datos restringidos"
    }
  ],
  "lastModified": "2026-06-17T04:57:06.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAD07421-BA29-47E8-B96B-424C35194F2F"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F68655B-5ED9-4B1C-9E7E-4374F5A31AFE"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "272D6C41-9E30-4A70-BAD7-A94D8EE51167"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43E695DF-8CB1-49AA-BFEC-18336C2FCF8D"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA050720-1DC3-4B74-9AE4-5212D4A81938"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT@rockwellautomation.com"
}