Vulnerability-Lookup - Search a vulnerability

Vulnerabilites related to aveva - aveva_plant_scada

cve-2023-1256

Vulnerability from cvelistv5

Published

2023-03-16 18:33

Modified

2025-01-16 21:42

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.

References

▼	URL	Tags
	https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04

Impacted products

Vendor

Product

Version

▼

AVEVA

AVEVA Plant SCADA

Version: 2023 Update 10

	AVEVA	AVEVA Plant SCADA	Version: 2020R2 Update 10
	AVEVA	AVEVA Telemetry Server	Version: 2020 R2 SP1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:40:59.774Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1256",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T20:58:54.332556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:42:14.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVEVA Plant SCADA",
          "vendor": "AVEVA",
          "versions": [
            {
              "status": "affected",
              "version": "2023 Update 10"
            }
          ]
        },
        {
          "product": "AVEVA Plant SCADA",
          "vendor": "AVEVA",
          "versions": [
            {
              "status": "affected",
              "version": "2020R2 Update 10"
            }
          ]
        },
        {
          "product": "AVEVA Telemetry Server",
          "vendor": "AVEVA",
          "versions": [
            {
              "status": "affected",
              "version": "2020 R2 SP1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-285 Improper Authorization",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T18:33:52.907Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2023-1256",
      "x_generator": {
        "engine": "VINCE 2.0.7",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2023-1256"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2023-1256",
    "datePublished": "2023-03-16T18:33:52.907Z",
    "dateReserved": "2023-03-07T16:15:30.636Z",
    "dateUpdated": "2025-01-16T21:42:14.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd