Lucene search

ABBCVE-2024-5622

HistoryAug 29, 2024 - 11:15 a.m.

CVE-2024-5622

2024-08-2911:15:27

CWE-250

CWE-426

CWE-267

ABB

web.nvd.nist.gov

cve-2024-5622

aprol

b&r

untrusted search path

arbitrary code execution

elevated privileges

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.2

Confidence

High

EPSS

Percentile

9.6%

JSON

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.

Affected configurations

Nvd

Node

br-automationindustrial_automation_aprolRange≤r4.2-07p3

br-automationindustrial_automation_aprolRanger4.3-00p3–r4.4-00p3

VendorProductVersionCPE
br-automationindustrial_automation_aprol*cpe:2.3:a:br-automation:industrial_automation_aprol:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
br-automation	industrial_automation_aprol	*	cpe:2.3:a:br-automation:industrial_automation_aprol::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "AprolConfigureCCServices"
    ],
    "product": "B&R APROL",
    "vendor": "B&R Industrial Automation",
    "versions": [
      {
        "lessThanOrEqual": "<= R 4.2-07P3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "<= R 4.4-00P3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.br-automation.com/fileadmin/SA24P2014_Multiple_vulnerabilities_in_BR_APROL.pdf-367290ae.pdf

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.2

Confidence

High

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-5622