What is CVE-2022-22732?

CVE-2022-22732 is a low-severity vulnerability in Schneider Electric Ecostruxure Power Commission, classified under Exposure of Resource to Wrong Sphere. CVSS score: 3.9/10. Published 2023-01-30.

How severe is CVE-2022-22732?

Low severity. CVSS v3 base score is 3.9 out of 10.

Vulnerability in Schneider Electric Ecostruxure Power Commission

CVE-2022-22732

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)

EPSS: 0.003 (18.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N.

Affected products

Schneider Electric Ecostruxure Power Commission — versions All
Schneider-electric Ecostruxure_power_commission

Weakness classification (CWE)

CWE-668 — Exposure of Resource to Wrong Sphere

References

cybersecurity@se.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2022-22732?: CVE-2022-22732 is a low-severity vulnerability in Schneider Electric Ecostruxure Power Commission, classified under Exposure of Resource to Wrong Sphere. CVSS score: 3.9/10. Published 2023-01-30.
How severe is CVE-2022-22732?: Low severity. CVSS v3 base score is 3.9 out of 10.