PT-2022-5829 · Aveva · Aveva Edge

Published 2022-11-22 · Updated 2023-12-20 · CVE-2021-42797

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior

Description The issue is related to a path traversal vulnerability that allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources. This can be exploited by sending a specially crafted HTTP request, potentially allowing a remote attacker to gain unauthorized access to protected information. The vulnerability is also related to the use of Windows UNC (UNCshare ame) resources.

Recommendations For AVEVA Edge versions R2020 and prior, update to a version later than R2020 to resolve the issue. As a temporary workaround, consider restricting access to external DB resources to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-40

Related Identifiers

BDU:2022-07236

CVE-2021-42797

Affected Products

Aveva Edge

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-42797 · Security Note
• https://bdu.fstec.ru/vul/2022-07236 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42797 · Vendor Advisory
• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-006.pdf · Note
• https://vuldb.com/ru/?id.214334 · Note
• https://aveva.com/en/products/edge · Note
• https://twitter.com/CVEnew/status/1735946010818642135 · Twitter Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-326-01 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-326-01 · Note