PT-2024-8348 · Aveva · Aveva Reports For Operations

Published 2024-07-09 · Updated 2024-08-14 · CVE-2024-6618

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dream Report versions (affected versions not specified) AVEVA Reports for Operations versions (affected versions not specified)

Description The issue is related to errors in processing relative path to directory, which could allow an attacker to perform remote code execution through the injection of a malicious dynamic-link library (DLL).

Recommendations For Dream Report, consider restricting access to vulnerable directories to minimize the risk of exploitation. For AVEVA Reports for Operations, avoid using relative paths in directory processing until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-09904

CVE-2024-6618

Affected Products

Aveva Reports For Operations

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6618 · Security Note
• https://bdu.fstec.ru/vul/2024-09904 · Security Note
• https://twitter.com/CVEnew/status/1823403003648598464 · Twitter Post
• https://twitter.com/CveFindCom/status/1823404888421716164 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-226-08 · Note
• https://t.me/cvedetector/3033 · Telegram Post
• https://vuldb.com/?id.274390 · Note
• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2024-006.pdf · Note
• https://twitter.com/PorsilapongoCl/status/1823404377702301777 · Twitter Post