CVE-2022-1467 - CVE House

Back to Database

Status published High CVE-2022-1467

AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

7.4 CVSS

Vulnerability Description

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-1467

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Giovanni Delvecchio from Aceaspa reported this vulnerability to AVEVA.

References

More from AVEVA

View All →

AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm

AVEVA Application Server IDE Basic Cross-site Scripting

AVEVA Process Optimization Uncontrolled Search Path Element

AVEVA Process Optimization Use of Potentially Dangerous Function

AVEVA Process Optimization Cleartext Transmission of Sensitive Information

Affected Vendor

AVEVA

View all reports →

Affected Software

AVEVA InTouch Access Anywhere, AVEVA Plant SCADA Access Anywhere

Vulnerable Versions:

all

Timeline

Official Publish: May 23rd, 2022

Last Modified: April 16th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1078 Valid Accounts