Vulnerability in Aveva Batch Management
CVE-2021-38410
AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (12.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Aveva Batch Management — versions 2020
- Aveva Enterprise Data Management — versions 2020
- Aveva Manufacturing Execution System — versions 2020
- Aveva Mobile Operator — versions 2020
- Aveva Platform Common Services — versions 4.4.6, 4.5.0, 4.5.1
- Aveva Platform Common Services (Pcs) Portal — versions 4.5.2, 4.5.1, 4.5.0
- Aveva System Platform — versions 2020
- Aveva Work Tasks — versions 2020
Weakness classification (CWE)
References
- www.cisa.gov/uscert/ics/advisories/icsa-21-252-01 (US Government Resource, Third Party Advisory)
- www.aveva.com/en/support-and-success/cyber-security-updates/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-38410?
- CVE-2021-38410 is a high-severity vulnerability in Aveva Batch Management, classified under Uncontrolled Search Path Element. CVSS score: 7.3/10. Published 2022-07-27.
- How severe is CVE-2021-38410?
- High severity. CVSS v3 base score is 7.3 out of 10.