Vulnerability · Published Aug 15, 2024 · Assigned by icscert
CVE-2024-6456SQL Injection vulnerability in AVEVA Historian Server
High 8.5
In plain English
A high-severity SQL injection in Historian Web Server from AVEVA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AVEVA | Historian Web Server | 2023R22023 – before 2023 P032020 – before 2020 R2 SP1 P01 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-10 government-resource