CVE-2023-34982

AVEVA Operations Control Logger External Control of File Name or Path

State: Published
Severity: 5.5 Medium
Published: Nov 15, 2023
Updated: Aug 2, 2024
Reserved: Jun 13, 2023

Description

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	icscert

Weaknesses

CWE-73 External Control of File Name or Path

Affected Products

Product	Versions
SystemPlatformAVEVA	2020 R2 SP1 P01 and earlierAffected
HistorianAVEVA	2020 R2 SP1 P01 and earlierAffected
Application ServerAVEVA	2020 R2 SP1 P01 and earlierAffected
InTouchAVEVA	2020 R2 SP1 P01 and earlierAffected
Enterprise Licensing (formerly known as License Manager)AVEVA	3.7.002 and earlierAffected
Manufacturing Execution System (formerly known as Wonderware MES)AVEVA	2020 P01 and earlierAffected
Recipe ManagementAVEVA	2020 R2 Update 1 Patch 2 and earlierAffected
Batch ManagementAVEVA	2020 SP1 and earlierAffected
Edge (formerly known as Indusoft Web Studio)AVEVA	2020 R2 SP1 P01 and earlierAffected
Worktasks (formerly known as Workflow Management)AVEVA	2020 U2 and earlierAffected
Plant SCADA (formerly known as Citect)AVEVA	2020 R2 Update 15 and earlierAffected
Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds)AVEVA	2020 R1 and earlierAffected
Communication Drivers PackAVEVA	2020 R2 SP1 and earlierAffected
Telemetry ServerAVEVA	2020 R2 SP1 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.