CVEvulnerability
CVE-2022-35890
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-07-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-863
Description
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy.
Affected configurations
• inductiveautomation ignition (< 7.9.20)
• inductiveautomation ignition (>= 8.0.1 < 8.1.17)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/sourceincite/randy Exploit, Third Party Advisory
- https://support.inductiveautomation.com/hc/en-us/articles/7625759776653 Vendor Advisory
- https://github.com/sourceincite/randy Exploit, Third Party Advisory
- https://support.inductiveautomation.com/hc/en-us/articles/7625759776653 Vendor Advisory