CVE-2022-1467 HIGH

CVE-2022-1467: AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

Vendor Aveva
Product AVEVA InTouch Access Anywhere
Weakness CWE-668
Published May 23, 2022
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.

Key dates

02Disclosure timeline

May 23, 2022 CVE published
April 16, 2025 Record updated