Vulnerability in Aveva Batch_management
CVE-2021-38410
AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the s…
EPSS: 0.002 (11.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Aveva Batch_management — versions 2020
- Aveva Enterprise_data_management — versions 2020
- Aveva Manufacturing_execution_system — versions 2020
- Aveva Mobile_operator — versions 2020
- Aveva Platform_common_services — versions 4.4.6, 4.5.0, 4.5.1
- Aveva Platform Common Services (Pcs) Portal — versions 4.5.2, 4.5.1, 4.5.0
- Aveva System_platform — versions 2020
- Aveva Work_tasks — versions 2020
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (x_refsource_CONFIRM, US Government Resource, Third Party Advisory)
- ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-38410?
- CVE-2021-38410 is a high-severity vulnerability in Aveva Batch_management, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2022-07-27.
- How severe is CVE-2021-38410?
- High severity. CVSS v3 base score is 7.3 out of 10.