CVE-2022-28320: 
Bentley MicroStation CONNECT vulnerability analysis and mitigation

CVE-2022-28320 is a vulnerability discovered in Bentley View version 10.16.02.022 and prior versions. The vulnerability was disclosed on April 12, 2022, and affects the parsing of 3DM files in Bentley View and MicroStation-based applications. The issue stems from improper initialization of memory prior to accessing it, which could allow remote attackers to execute arbitrary code (ZDI Advisory, Bentley Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The specific flaw exists within the parsing of 3DM files, where the lack of proper initialization of memory prior to accessing it creates a security risk. The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. This could potentially lead to complete compromise of the affected system, with high impacts on confidentiality, integrity, and availability of the system (ZDI Advisory).

The vulnerability requires user interaction for exploitation, specifically requiring the target to open a maliciously crafted 3DM file. The attack complexity is considered low, and no special privileges are required for exploitation. The vulnerability was tracked as ZDI-CAN-16282 (Bentley Advisory, ZDI Advisory).

Bentley has released version 10.16.03 and more recent versions to address this vulnerability. Users are recommended to update to the latest versions of MicroStation and MicroStation-based applications. As a general best practice, Bentley also recommends only opening 3DM files from trusted sources (Bentley Advisory).