CVE-2024-11220

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://openautomationsoftware.com/downloads/	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03	US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:openautomationsoftware:open_automation_software:*:*:*:*:*:*:*:*

History

23 Jan 2025, 16:54

Type	Values Removed	Values Added
First Time		Openautomationsoftware open Automation Software Openautomationsoftware
CWE		CWE-732
CPE		cpe:2.3:a:openautomationsoftware:open_automation_software::::::::
References	~~() https://openautomationsoftware.com/downloads/ -~~	() https://openautomationsoftware.com/downloads/ - Product
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03 - US Government Resource

06 Dec 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-06 18:15

Updated : 2025-01-23 16:54

NVD link : CVE-2024-11220

Mitre link : CVE-2024-11220

CVE.ORG link : CVE-2024-11220

JSON object : View

Products Affected

openautomationsoftware

open_automation_software

CWE

CWE-279

Incorrect Execution-Assigned Permissions

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2024-11220", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.5, "automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-12-06T18:15:22.407", "references": [{"url": "https://openautomationsoftware.com/downloads/", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-279"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation."}, {"lang": "es", "value": "Un usuario local de bajo nivel en la m\u00e1quina servidor con credenciales para los servicios OAS en ejecuci\u00f3n puede crear y ejecutar un informe con un archivo rdlx en el propio sistema servidor. Cualquier c\u00f3digo dentro del archivo rdlx del informe se ejecuta con privilegios de SYSTEM, lo que da como resultado una escalada de privilegios."}], "lastModified": "2025-01-23T16:54:24.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openautomationsoftware:open_automation_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FDFE998-61DE-45FB-B117-550F3000BD9B", "versionEndExcluding": "20.0.0.76"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}