Vulnerability · Published Sep 5, 2023 · Assigned by talos
CVE-2023-31242
High 8.1
In plain English
A high-severity improper access control in OAS Platform from Open Automation Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)3.5%top 10.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Automation Software | OAS Platform | v18.00.0072 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H