Improper access control in Lumada APM – SaaS and Lumada APM – On Premises - CVE-2022-2155

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions on the "Limited Engineer" role. A remote user can bypass implemented security restrictions and gain unauthorized access to sensitive information on the system.

Affected software

How to mitigate CVE-2022-2155

External References

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000112&LanguageCode=en&DocumentPartId=&Action=Launch
• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-07

Related Security Bulletins

• Improper access control in Hitachi Energy Lumada APM