Vulnerability · Published Apr 3, 2024 · Assigned by talos
CVE-2024-27201
Medium 4.9
In plain English
A medium-severity improper input validation in OAS Platform from Open Automation Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Automation Software | OAS Platform | V19.00.0057 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N