PT-2022-10174 · Aveva · Aveva System Platform

Sharon Brizinov · Published 2022-04-04 · Updated 2022-04-13 · CVE-2021-32981

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVEVA System Platform versions 2017 through 2020 R2 P01

Description The issue arises from the software's failure to properly neutralize special elements within a pathname that is constructed using external input. This pathname is intended to identify a file or directory located underneath a restricted parent directory. However, due to the lack of proper neutralization of special elements, the pathname can resolve to a location outside of the restricted directory.

Recommendations For AVEVA System Platform versions 2017 through 2020 R2 P01, consider implementing input validation to ensure that external inputs used in constructing pathnames do not contain special elements that could lead to accessing files or directories outside the intended restricted directory. As a temporary workaround, restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-32981

Affected Products

Aveva System Platform

References · 5

• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32981 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-180-05 · Note
• https://t.me/cvenotify/28825 · Telegram Post