An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.
Description: CWE-471 Modification of Assumed-Immutable Data (MAID)
Metrics
Version
Base score
Base severity
Vector
3.1
5.0
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Version:3.1
Base score:5.0
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Configurations
Workarounds
Users are discouraged from using documents from unknown/untrusted sources.
Users are encouraged to store .ctl files in a folder only writeable by admin-level users.
Users are encouraged to operate in “Safe Mode” when loading documents that have been out of their control.
Users are encouraged to apply a document editing password to their documents.
Users should avoid using the Real Time Web-Connect menu items and instead connect to DAQConnect using script.
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.