CVE-2022-43651: 
Bentley View vulnerability analysis and mitigation

Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVE-2022-43651) was discovered and disclosed on March 31, 2023. This vulnerability affects Bentley View installations and requires user interaction, specifically opening a malicious file or visiting a malicious page. The vulnerability was assigned a CVSS score of 7.8 (High) (ZDI Advisory).

The vulnerability exists within the parsing of SKP files in Bentley View. The specific flaw stems from the lack of validation for object existence before performing operations on the object. This use-after-free condition can be exploited to execute arbitrary code in the context of the current process (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code on affected installations of Bentley View, potentially leading to complete system compromise with the privileges of the current process (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker needs to convince a target to either visit a malicious webpage or open a malicious file. The vulnerability was assigned a CVSS vector of CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (ZDI Advisory).

The vulnerability has been fixed in Bentley View version 17.2. Users are advised to upgrade to this version or later to mitigate the risk (ZDI Advisory).