PT-2024-12265 · Aveva · Aveva Pi Server

Aveva · Published 2024-01-18 · Updated 2024-01-26 · CVE-2023-31274

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior

Description The issue allows an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory, resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition.

Recommendations For AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2023-31274

Affected Products

Aveva Pi Server

References · 5

• https://osv.dev/vulnerability/CVE-2023-31274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31274 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-018-01 · Note
• https://t.me/cvenotify/68831 · Telegram Post
• https://twitter.com/CVEnew/status/1748037701524205889 · Twitter Post