Lucene search

ABBCVE-2024-5623

HistoryAug 29, 2024 - 11:15 a.m.

CVE-2024-5623

2024-08-2911:15:27

CWE-250

CWE-426

CWE-267

ABB

web.nvd.nist.gov

untrusted search path

b&r aprol

local attacker

arbitrary code

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

5.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.1

Confidence

High

EPSS

Percentile

9.6%

JSON

An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.

Affected configurations

Nvd

Node

br-automationindustrial_automation_aprolRange≤r4.4-00p3

VendorProductVersionCPE
br-automationindustrial_automation_aprol*cpe:2.3:a:br-automation:industrial_automation_aprol:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
br-automation	industrial_automation_aprol	*	cpe:2.3:a:br-automation:industrial_automation_aprol::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "B&R APROL",
    "vendor": "B&R Industrial Automation",
    "versions": [
      {
        "lessThanOrEqual": "<= R 4.4-00P3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.br-automation.com/fileadmin/SA24P2014_Multiple_vulnerabilities_in_BR_APROL.pdf-367290ae.pdf

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

5.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.1

Confidence

High

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-5623