CVE-2022-43656: 
Bentley View vulnerability analysis and mitigation

CVE-2022-43656 is a vulnerability discovered in Bentley View software that involves an out-of-bounds read information disclosure issue. The vulnerability was reported on August 25, 2022, and publicly disclosed on March 31, 2023. This security flaw affects the FBX file parsing functionality in Bentley View installations (ZDI Advisory).

The vulnerability exists within the parsing of FBX files in Bentley View. When processing crafted data in an FBX file, it can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (LOW) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-125 (Out-of-bounds Read) (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View. The impact is limited to information disclosure, with no direct impact on system integrity or availability. However, an attacker can potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, but requires local access and user interaction to be successful (ZDI Advisory).

The vulnerability has been fixed in Bentley View version 17.1. Users are advised to upgrade to this version or later to mitigate the risk (ZDI Advisory).