CVE-2021-38410

AVEVA PCS Portal Uncontrolled Search Path Element

State: Published
Severity: 7.3 High
Published: Jul 27, 2022
Updated: Apr 17, 2025
Reserved: Aug 10, 2021

Description

AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
Platform Common Services (PCS) PortalAVEVA	4.5.2Affected 4.5.1Affected 4.5.0Affected 4.4.6Affected

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01
https://www.aveva.com/en/support-and-success/cyber-security-updates/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.