Vulnerability · Published Apr 4, 2022 · Assigned by icscert

CVE-2021-32981AVEVA System Platform Path Traversal

High 7.2

In plain English

A high-severity path traversal in AVEVA System Platform from AVEVA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.2%top 31.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected products (as reported)

Vendor	Product	Versions
AVEVA	AVEVA System Platform	2017 – through 2020 R2 P01

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05 x_refsource_CONFIRM
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf x_refsource_CONFIRM