Lucene search

IcscertCVE-2024-3468

HistoryJun 12, 2024 - 9:15 p.m.

CVE-2024-3468

2024-06-1221:15:50

CWE-502

icscert

web.nvd.nist.gov

cve-2024-3468

aveva pi web api

code execution

xml import

interactive user

attacker

privilege escalation

CVSS4

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

ACTIVE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/SC:N/VI:H/SI:N/VA:L/SA:N

AI Score

7.3

Confidence

High

EPSS

Percentile

9.0%

JSON

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PI Web API",
    "vendor": "AVEVA",
    "versions": [
      {
        "lessThanOrEqual": "2023",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-163-02