Remote Information Disclosure Vulnerability in Bentley View by Bentley Systems

CVE-2022-28308

Summary

A vulnerability exists in Bentley View 10.16.02.022 that enables remote attackers to disclose sensitive user information. The issue arises from a flaw in the parsing of 3DS files, allowing crafted data to trigger a read beyond the end of an allocated buffer. Utilize of this vulnerability requires user interaction, as the target must visit a malicious website or open a harmful file. Successful exploitation could allow attackers to execute arbitrary code within the current process, potentially leveraging it in conjunction with other vulnerabilities to enhance their impact.

References