CVE-2022-41851

A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The JTTK library is vulnerable to an uninitialized pointer reference vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-16973)

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-611756.pdf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:jt_open_toolkit::::::::
	cpe:2.3:a:siemens:simcenter_femap::::::::
	cpe:2.3:a:siemens:simcenter_femap::::::::

History

12 Oct 2022, 14:30

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
First Time		Siemens jt Open Toolkit Siemens simcenter Femap Siemens
CPE		cpe:2.3:a:siemens:simcenter_femap:::::::: cpe:2.3:a:siemens:jt_open_toolkit::::::::
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-611756.pdf -~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-611756.pdf - Patch, Vendor Advisory

11 Oct 2022, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-10-11 11:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-41851

Mitre link : CVE-2022-41851

CVE.ORG link : CVE-2022-41851

JSON object : View

Products Affected

siemens

jt_open_toolkit
simcenter_femap

CWE

CWE-824

Access of Uninitialized Pointer

{"id": "CVE-2022-41851", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-10-11T11:15:11.120", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-611756.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-824"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The JTTK library is vulnerable to an uninitialized pointer reference vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-16973)"}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en JTTK (Todas las versiones anteriores a V11.1.1.0), Simcenter Femap V2022.1 (Todas las versiones anteriores a V2022.1.3), Simcenter Femap V2022.2 (Todas las versiones anteriores a V2022.2.2). La biblioteca JTTK es susceptible a una vulnerabilidad de referencia de puntero no inicializada mientras analiza archivos JT especialmente dise\u00f1ados. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. (ZDI-CAN-16973)"}], "lastModified": "2022-10-12T14:30:54.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E5FA782-E074-4406-ACA6-788DD24327C7", "versionEndExcluding": "11.1.1.0"}, {"criteria": "cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CC6B707-5527-4A4F-BA46-C2EE6CCF8E56", "versionEndExcluding": "2022.1.3", "versionStartIncluding": "2022.1.0"}, {"criteria": "cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98BF38F3-E62A-4913-A300-EF7F3001BC64", "versionEndExcluding": "2022.2.2", "versionStartIncluding": "2022.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}