VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Apr 1, 2022· Updated Jun 17, 2026

CVE-2022-1018

CVE-2022-1018

Description

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

Affected products

6
  • Rockwellautomation/Connected Components Workbench2 versions
    cpe:2.3:a:rockwellautomation:connected_components_workbench:*:*:*:*:-:*:*:*+ 1 more
    • cpe:2.3:a:rockwellautomation:connected_components_workbench:*:*:*:*:-:*:*:*range: <=12.0
    • (no CPE)range: All
  • Rockwellautomation/Isagraf2 versions
    cpe:2.3:a:rockwellautomation:isagraf:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:rockwellautomation:isagraf:*:*:*:*:*:*:*:*range: <=6.6.9
    • (no CPE)range: All
  • Rockwellautomation/Safety Instrumented Systems Workstation2 versions
    cpe:2.3:o:rockwellautomation:safety_instrumented_systems_workstation:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:rockwellautomation:safety_instrumented_systems_workstation:*:*:*:*:*:*:*:*range: <=1.1
    • (no CPE)range: All

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.