PT-2022-10717 · Aveva · Aveva Software Platform Common Services (Pcs) Portal

Noam Moshe · Published 2022-07-27 · Updated 2022-08-04 · CVE-2021-38410

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVEVA Software Platform Common Services (PCS) Portal versions 4.4.6, 4.5.0, 4.5.1, 4.5.2

Description The issue is related to DLL hijacking through an uncontrolled search path element. This may allow an attacker to control one or more locations in the search path.

Recommendations For versions 4.4.6, 4.5.0, 4.5.1, 4.5.2, consider restricting access to the search path to minimize the risk of exploitation. As a temporary workaround, limit the ability of attackers to control locations in the search path until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-38410

Affected Products

Aveva Software Platform Common Services (Pcs) Portal

References · 5

• https://aveva.com/en/support-and-success/cyber-security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38410 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38410 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-21-252-01 · Note
• https://t.me/cibsecurity/47127 · Telegram Post