CVE-2021-32981
Assigner: icscert
Published: 2022-04-04T19:45:50
State: PUBLISHED
affected: product: AVEVA System Platform
vendor: AVEVA
versions: lessThanOrEqual: 2020 R2 P01
status: affected
version: 2017
versionType: custom
credits: value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
descriptions: value: AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-22
description: CWE-22: Path Traversal
type: CWE
solutions: value: AVEVA recommends organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

AutoBuild service is intended to be used only on the GR Node of System Platform during configuration. If the AutoBuild service is enabled on any Runtime nodes, it should be disabled. Furthermore, if the AutoBuild functionality is not used on the GR Node, the AutoBuild service can be disabled on the GR Node as an alternative mitigation that does not require patching.

AVEVA recommends users who need to continually use the AutoBuild functionality and cannot disable it in System Platform Versions 2017 through 2020 R2 P01 (inclusive) are affected by the vulnerabilities and should first upgrade to one of the System Platform versions listed below, then apply the corresponding security update:
    System Platform 2020 R2 P01, 2020 R2, 2020: Apply AVEVA Communication Drivers Pack 2020 R2.1
    System Platform 2017 U3 SP1 P01: 

First apply AVEVA Communication Drivers Pack 2020 R2  AVEVA notes that Activated Licensing is required to apply AVEVA Communication Drivers Pack 2020 R2 on top of System Platform 2017 U3 SP1 P01. For information on AVEVA license compatibility, please contact AVEVA Customer Support.
Then apply AVEVA Communication Drivers Pack 2020 R2.1

Please see AVEVA’s security bulletin AVEVA-2021-002 for more information.
source: discovery: EXTERNAL
title: AVEVA System Platform Path Traversal
x_generator: engine: Vulnogram 0.0.9