CVE-2022-38743
First published: Mon Oct 17 2022(Updated: )
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwellautomation Factorytalk Vantagepoint | =8.0 | |
| Rockwellautomation Factorytalk Vantagepoint | =8.10 | |
| Rockwellautomation Factorytalk Vantagepoint | =8.20 | |
| Rockwellautomation Factorytalk Vantagepoint | =8.30 | |
| Rockwellautomation Factorytalk Vantagepoint | =8.31 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability in Rockwell Automation FactoryTalk VantagePoint?
The vulnerability ID for this vulnerability in Rockwell Automation FactoryTalk VantagePoint is CVE-2022-38743.
What is the severity of CVE-2022-38743?
The severity of CVE-2022-38743 is high with a CVSS score of 8.8.
Which versions of Rockwell Automation FactoryTalk VantagePoint are affected by CVE-2022-38743?
Versions 8.0, 8.10, 8.20, 8.30, 8.31 of Rockwell Automation FactoryTalk VantagePoint are affected by CVE-2022-38743.
What is the impact of CVE-2022-38743?
CVE-2022-38743 allows a malicious user with read-only privileges to execute SQL statements in the back-end database.
How can I fix CVE-2022-38743 in Rockwell Automation FactoryTalk VantagePoint?
To fix CVE-2022-38743, it is recommended to apply the latest security updates provided by Rockwell Automation.
- collector/nvd-index
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/weakness
- agent/references
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/rockwellautomation
- canonical/rockwellautomation factorytalk vantagepoint
- version/rockwellautomation factorytalk vantagepoint/8.0
- version/rockwellautomation factorytalk vantagepoint/8.10
- version/rockwellautomation factorytalk vantagepoint/8.20
- version/rockwellautomation factorytalk vantagepoint/8.30
- version/rockwellautomation factorytalk vantagepoint/8.31