PT-2024-5850 · Aveva · Aveva Historian Server

Maurizio Gatti · Published 2024-08-15 · Updated 2024-08-19 · CVE-2024-6456

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions AVEVA Historian Server (affected versions not specified)

Description The issue is related to the lack of protection against malicious SQL commands. If exploited, it could allow a remote attacker to execute arbitrary code under the privileges of an interactive Historian REST Interface user, provided the user opens a specially crafted URL. This could potentially be achieved through social engineering tactics.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-06595

CVE-2024-6456

Affected Products

Aveva Historian Server

References · 9

• https://bdu.fstec.ru/vul/2024-06595 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6456 · Security Note
• https://twitter.com/CveFindCom/status/1824182336721703013 · Twitter Post
• https://twitter.com/CVEnew/status/1824181627536199733 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-228-10 · Note
• https://extlogon.aveva.com/adfs/ls/?wa=wsignin1.0&wtrealm=urn%3asharepoint%3asoftwaresupportsp.avv&wctx=https%3a%2f%2fsoftwaresupportsp.aveva.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F#/producthub/details?id=f9477c62-1966-4020-8909-fa20f4ef2b2b · Note
• https://t.me/cvedetector/3289 · Telegram Post
• https://aveva.com/en/support-and-success/support-contact · Note
• https://extlogon.aveva.com/adfs/ls/?wa=wsignin1.0&wtrealm=urn%3asharepoint%3asoftwaresupportsp.avv&wctx=https%3a%2f%2fsoftwaresupportsp.aveva.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F#/producthub/details?id=f9477c62-1966-4020-8909-fa20f4ef2b2b · Note