CVE-2022-2155: A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.
First published: Thu Jan 12 2023(Updated: )
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer. Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker. Affected versions * Lumada APM on-premises version 6.0.0.0 - 6.4.0.* List of CPEs: * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*
Credit: cybersecurity@hitachienergy.com cybersecurity@hitachienergy.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachienergy Lumada Asset Performance Management | >=6.0.0.0<6.4.0.1 |
Remedy
* For Lumada APM version 6.4.0.* – Update to Lumada APM version 6.4.0.1, or upgrade to Lumada APM version 6.5.0.0 (or newer). * For Lumada APM versions prior to 6.4.0.0 – Upgrade to Lumada APM version 6.4.0.1 or 6.5.0.0 or newer.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the CVE-ID of this vulnerability?
The CVE-ID of this vulnerability is CVE-2022-2155.
What is the severity level of CVE-2022-2155?
The severity level of CVE-2022-2155 is high with a CVSS score of 7.1.
Which software versions are affected by this vulnerability?
The affected software versions are Lumada Asset Performance Management on-premises versions 6.0.0.0 through 6.4.0.1.
What is the CWE-ID of this vulnerability?
The CWE-ID of this vulnerability is CWE-863.
How can I fix the vulnerability CVE-2022-2155?
To fix the vulnerability CVE-2022-2155, update Lumada Asset Performance Management to a version beyond 6.4.0.1.
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/references
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/hitachienergy
- canonical/hitachienergy lumada asset performance management
- version/hitachienergy lumada asset performance management/6.0.0.0