Vulnerability · Published Apr 3, 2024 · Assigned by talos
CVE-2024-21870
Medium 4.9
In plain English
A medium-severity security flaw in OAS Platform from Open Automation Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Automation Software | OAS Platform | V19.00.0057 |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N