CVE-2024-3467

There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:aveva:pi_asset_framework_client:2018:sp3_patch_4::::::
	cpe:2.3:a:aveva:pi_asset_framework_client:2023:::::::*

History

03 Oct 2024, 19:47

Type	Values Removed	Values Added
CPE		cpe:2.3:a:aveva:pi_asset_framework_client:2023:::::::* cpe:2.3:a:aveva:pi_asset_framework_client:2018:sp3_patch_4::::::
First Time		Aveva pi Asset Framework Client Aveva
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03 - Third Party Advisory, US Government Resource

13 Jun 2024, 18:36

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en AVEVA PI Asset Framework Client que podría permitir que se ejecute código malicioso en el entorno de PI System Explorer bajo los privilegios de un usuario interactivo que fue manipulado socialmente para importar XML proporcionado por un atacante.

12 Jun 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-12 21:15

Updated : 2024-10-03 19:47

NVD link : CVE-2024-3467

Mitre link : CVE-2024-3467

CVE.ORG link : CVE-2024-3467

JSON object : View

Products Affected

aveva

pi_asset_framework_client

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-3467", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 7.0, "automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-06-12T21:15:50.617", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker."}, {"lang": "es", "value": "Existe una vulnerabilidad en AVEVA PI Asset Framework Client que podr\u00eda permitir que se ejecute c\u00f3digo malicioso en el entorno de PI System Explorer bajo los privilegios de un usuario interactivo que fue manipulado socialmente para importar XML proporcionado por un atacante."}], "lastModified": "2024-10-03T19:47:06.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aveva:pi_asset_framework_client:2018:sp3_patch_4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB4DB2C1-BFA8-4CCB-A1A7-D14AD828DA02"}, {"criteria": "cpe:2.3:a:aveva:pi_asset_framework_client:2023:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF232070-675E-4886-A190-6B5A04DCC729"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}