Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.
References
| Link | Resource |
|---|---|
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 | Permissions Required Vendor Advisory |
| https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 | Permissions Required Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 - Permissions Required, Vendor Advisory |
20 Oct 2022, 14:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (MISC) https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 - Permissions Required, Vendor Advisory | |
| CPE | cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.10:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.20:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.31:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.30:*:*:*:*:*:*:* cpe:2.3:a:rockwellautomation:factorytalk_vantagepoint:8.0:*:*:*:*:*:*:* |
17 Oct 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-17 22:15
Updated : 2025-05-14 19:15
NVD link : CVE-2022-3158
Mitre link : CVE-2022-3158
CVE.ORG link : CVE-2022-3158
JSON object : View
Products Affected
rockwellautomation
- factorytalk_vantagepoint
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')