CVE-2022-2155
A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer.
Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.
Affected versions
- Lumada APM on-premises version 6.0.0.0 - 6.4.0.*
List of CPEs:
- cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role.
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer.
Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.
Affected versions
- Lumada APM on-premises version 6.0.0.0 - 6.4.0.*
List of CPEs:
- cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
- Record
CVE-2022-2155- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2022-34440
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer.
Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.
Affected versions
- Lumada APM on-premises version 6.0.0.0 - 6.4.0.*
List of CPEs:
- cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
- Record
EUVD-2022-34440- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5497-8frw-qm4r
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a...
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer. Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker. Affected versions * Lumada APM on-premises version 6.0.0.0 - 6.4.0.* List of CPEs: * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::* * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
- Record
GHSA-5497-8frw-qm4r- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer’s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer.
Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker.
Affected versions
- Lumada APM on-premises version 6.0.0.0 - 6.4.0.*
List of CPEs:
- cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:::::::*
- cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:::::::*
- Record
CVE-2022-2155- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2155 is a medium vulnerability (CVSS 5.7) in Hitachi Energy Lumada Apm, published January 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.