CVE-2024-3468 Vulnerability Details

  /     /     /  

CVE-2024-3468 Metadata Quick Info

CVE Published: 12/06/2024 | CVE Updated: 01/08/2024 | CVE Year: 2024
Source: icscert | Vendor: AVEVA | Product: PI Web API
Status : PUBLISHED

---

CVE-2024-3468 Description

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-502
CWE Name: CWE-502 Deserialization of Untrusted Data
Source: AVEVA

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).