Lucene search
HistoryJul 27, 2022 - 9:15 p.m.
CVE-2021-38410
cve-2021-38410
aveva pcs
dll hijacking
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
28.7%
AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.
Affected configurations
Node
avevabatch_managementMatch2020
ORavevaenterprise_data_managementMatch2020
ORavevamanufacturing_execution_systemMatch2020
ORavevamobile_operatorMatch2020
ORavevaplatform_common_servicesMatch4.4.6
ORavevaplatform_common_servicesMatch4.5.0
ORavevaplatform_common_servicesMatch4.5.1
ORavevaplatform_common_servicesMatch4.5.2
ORavevasystem_platformMatch2020-
ORavevasystem_platformMatch2020r2
ORavevasystem_platformMatch2020r2_p01
ORavevawork_tasksMatch2020-
ORavevawork_tasksMatch2020update_1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| aveva | batch_management | 2020 | cpe:2.3:a:aveva:batch_management:2020:*:*:*:*:*:*:* |
| aveva | enterprise_data_management | 2020 | cpe:2.3:a:aveva:enterprise_data_management:2020:*:*:*:*:*:*:* |
| aveva | manufacturing_execution_system | 2020 | cpe:2.3:a:aveva:manufacturing_execution_system:2020:*:*:*:*:*:*:* |
| aveva | mobile_operator | 2020 | cpe:2.3:a:aveva:mobile_operator:2020:*:*:*:*:*:*:* |
| aveva | platform_common_services | 4.4.6 | cpe:2.3:a:aveva:platform_common_services:4.4.6:*:*:*:*:*:*:* |
| aveva | platform_common_services | 4.5.0 | cpe:2.3:a:aveva:platform_common_services:4.5.0:*:*:*:*:*:*:* |
| aveva | platform_common_services | 4.5.1 | cpe:2.3:a:aveva:platform_common_services:4.5.1:*:*:*:*:*:*:* |
| aveva | platform_common_services | 4.5.2 | cpe:2.3:a:aveva:platform_common_services:4.5.2:*:*:*:*:*:*:* |
| aveva | system_platform | 2020 | cpe:2.3:a:aveva:system_platform:2020:-:*:*:*:*:*:* |
| aveva | system_platform | 2020 | cpe:2.3:a:aveva:system_platform:2020:r2:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2021-38410 AVEVA PCS Portal Uncontrolled Search Path Element
2022-07-27 20:23:04
ics
ics
AVEVA PCS Portal
2021-09-09 12:00:00
prion
prion
Path traversal
2022-07-27 21:15:00
cve
cve
CVE-2021-38410
2022-07-27 21:15:08
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
28.7%
Related for NVD:CVE-2021-38410