CVE-2022-45876

Back Back to CVE browser

MEDIUM

Published Apr 26, 2023

5.5

MEDIUM

CVSS 3.1

EPSS 3.33%

Description

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.

Affected products

Vendor Visam Product Vbase Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <11.7.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Visam

Vbase

unaffected

Version	Status	Constraints
0	affected	<11.7.5

Remediation

Vendor solution

VISAM recommends users update to VBASE 11.7.5 or later. The update can be performed via the VBASE Editor update dialog on machines with secure access to the internet. Users of machines without internet access must manually update by submitting a request form https://www.vbase.net/en/download.php to receive a download link.For more information, users should contact VISAM using the information provided on their contact page https://www.visam.com/kontakt.php (German language).

Weaknesses (1)

CWE-611

XXE

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48727
Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
Third Party AdvisoryUS Government Resource
https://www.vbase.net/en/download.php
Product
https://www.visam.com/kontakt.php
Product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48727		Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05		Third Party AdvisoryUS Government Resource
https://www.vbase.net/en/download.php		Product
https://www.visam.com/kontakt.php		Product