CVE-2022-43653: 
Bentley View vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2022-43653) was discovered in Bentley View software, specifically in its SKP file parsing functionality. The vulnerability was reported on October 6, 2022, and publicly disclosed on March 31, 2023. This vulnerability affects installations of Bentley View and requires user interaction, such as visiting a malicious page or opening a malicious file, to be exploited (ZDI Advisory).

The vulnerability exists within the parsing of SKP files in Bentley View. When processing crafted data in an SKP file, the application can trigger a write operation past the end of an allocated buffer, leading to an out-of-bounds write condition. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, user interaction required, and high impacts on confidentiality, integrity, and availability (ZDI Advisory).

A successful exploitation of this vulnerability allows attackers to execute arbitrary code in the context of the current process. This means an attacker could potentially take complete control of the affected system with the same privileges as the application running the malicious SKP file (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must either visit a malicious webpage or open a malicious SKP file. The attack complexity is considered low, meaning it does not require special conditions or circumstances to be exploited (ZDI Advisory).

The vulnerability has been fixed in Bentley View version 17.2. Users are advised to upgrade to this version or later to protect against this vulnerability (ZDI Advisory).