CVE-2022-2155CWE-863

A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.

Medium · published January 12, 2023

CVSS v3.1
5.7
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature

due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports

feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining

unauthorized access to any Power BI reports installed by the customer.

Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.

Affected versions

* Lumada APM on-premises version 6.0.0.0 - 6.4.0.*

List of CPEs:

* cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:*

* cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:*

* cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:*

* cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:*

* cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00372 · 29.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-01-12T14:01Z
EPSS history
Timeline
  • 12 JAN 14:01Z
    A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.
    cvelistv5