CVE-2022-35900 : What You Need to Know

This article provides an overview of CVE-2022-35900, a vulnerability discovered in Bentley MicroStation and Bentley View software versions before 10.17.0.x.

Understanding CVE-2022-35900

CVE-2022-35900 is a vulnerability that exists in Bentley MicroStation and Bentley View software versions before 10.17.0.x. An attacker can trigger an out-of-bounds read by using a vulnerable version of these applications to open a specially crafted JP2 file. This could potentially allow unauthorized access to sensitive information.

What is CVE-2022-35900?

The vulnerability in Bentley MicroStation and Bentley View software versions before 10.17.0.x allows for an out-of-bounds read when opening a maliciously crafted JP2 file. Exploitation of this flaw could lead to unauthorized access to data within the context of the current process.

The Impact of CVE-2022-35900

With a CVSS base score of 3.3 (Low severity), the vulnerability's impact is relatively mild. However, the potential for unauthorized information access poses a risk to affected systems.

Technical Details of CVE-2022-35900

Vulnerability Description

The security issue in Bentley MicroStation and Bentley View software versions before 10.17.0.x allows for an out-of-bounds read when processing JP2 files, potentially enabling an attacker to extract sensitive information.

Affected Systems and Versions

All versions of Bentley MicroStation and Bentley View software before 10.17.0.x are affected by this vulnerability.

Exploitation Mechanism

To exploit CVE-2022-35900, an attacker needs to lure a user into opening a malicious JP2 file using the vulnerable software, triggering the out-of-bounds read vulnerability.

Mitigation and Prevention

Immediate Steps to Take

Users are advised to update Bentley MicroStation and Bentley View to version 10.17.0.x or later to mitigate the risk of exploitation. Additionally, exercise caution when opening files from untrusted sources.

Long-Term Security Practices

Implementing security best practices, such as regular software updates and user training on safe file handling, can help prevent similar vulnerabilities in the future.

Patching and Updates

Bentley has released patches addressing CVE-2022-35900. Organizations should promptly apply these patches to secure their systems against potential attacks.