Remote Information Disclosure in Bentley MicroStation CONNECT

CVE-2022-28312

Summary

The vulnerability in Bentley MicroStation CONNECT allows remote attackers to access sensitive information by exploiting a flaw in the parsing of 3DS files. User interaction is necessary for an attack to succeed, as the target must either visit a malicious webpage or open a compromised file. This flaw can lead to a read past the end of an allocated buffer, potentially enabling attackers to combine this weakness with other vulnerabilities to execute arbitrary code in the context of the affected process. For further details, refer to the advisory from Bentley and the Zero Day Initiative.

References