CVE-2022-35905 : What You Need to Know

This article provides details about CVE-2022-35905, a vulnerability found in Bentley MicroStation and Bentley View software.

Understanding CVE-2022-20657

This section covers what CVE-2022-35905 entails, its impact, technical details, and mitigation strategies.

What is CVE-2022-20657?

CVE-2022-35905 is a vulnerability discovered in Bentley MicroStation and Bentley View software versions before 10.17.0.x. It allows an attacker to exploit a crafted FBX file, resulting in an out-of-bounds read. This could potentially disclose sensitive information.

The Impact of CVE-2022-20657

The vulnerability carries a CVSS base score of 3.3, indicating a low severity level. However, exploitation can lead to unauthorized access to process context information, posing a risk to confidentiality.

Technical Details of CVE-2022-20657

This section delves into the specifics of the vulnerability.

Vulnerability Description

Using a vulnerable MicroStation version to open a specially crafted FBX file may trigger an out-of-bounds read, compromising data confidentiality.

Affected Systems and Versions

Bentley MicroStation versions before 10.17.0.x and Bentley View versions before 10.17.0.x are impacted by this vulnerability.

Exploitation Mechanism

By inducing the parsing of malicious FBX files, threat actors can exploit this vulnerability to access sensitive information within the current software's context.

Mitigation and Prevention

This section outlines steps to mitigate the risks associated with CVE-2022-35905.

Immediate Steps to Take

Users should update Bentley MicroStation and Bentley View to versions 10.17.0.x or above to eliminate this vulnerability. Additionally, exercise caution while handling FBX files from untrusted sources.

Long-Term Security Practices

Employing robust cybersecurity measures, such as regular software updates, security awareness training, and monitoring file inputs, can enhance overall security posture.

Patching and Updates

Vendor-provided patches are essential for addressing this vulnerability effectively. Stay informed about security advisories from Bentley to promptly apply necessary updates.