CVE-2022-2155

<br /> A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature<br /> due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports<br /> feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining<br /> unauthorized access to any Power BI reports installed by the customer. <br /> <br /> Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.<br /> <br /> <br /> <br /> Affected versions <br /> * Lumada APM on-premises version 6.0.0.0 - 6.4.0.*<br /> <br /> <br /> <br /> List of CPEs: <br /> * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:*<br /> * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:*<br /> * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:*<br /> * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:*<br /> * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*<br /> <br /> <br />