Vulnerability · Published Jan 18, 2024 · Assigned by icscert

CVE-2023-31274Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server

Medium 5.3

In plain English

A medium-severity security flaw in PI Server from Aveva. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition.

Affected products (as reported)

Vendor	Product	Versions
Aveva	PI Server	20230 – through 2018 SP3 P05

Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01 government-resource