ID
VAR-202106-1988
CVE
CVE-2021-33010
TITLE
AVEVA Made AVEVA System Platform Multiple vulnerabilities in
Trust: 0.8
DESCRIPTION
An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition. AVEVA Provided by the company AVEVA System Platform contains multiple vulnerabilities: * Lack of authentication for critical features (CWE-306) - CVE-2021-33008 It was * Problems with not handling exceptions (CWE-248) - CVE-2021-33010 It was * Path traversal (CWE-22) - CVE-2021-32981 It was * Same-origin policy violation (CWE-346) - CVE-2021-32985 It was * Improper verification of digital signatures (CWE-347) - CVE-2021-32977The expected impact depends on each vulnerability, but it may be affected as follows. It was * A third party on an adjacent network may be able to execute arbitrary code with system privileges. - CVE-2021-33008 It was * Service operation obstruction by a remote third party (DoS) state - CVE-2021-33010 It was * The input value that specifies a file or directory under an access-restricted directory is not processed properly, allowing a remote third party to access a directory outside the access-restricted directory. - CVE-2021-32981 It was * Not properly validating that data or communication origin is valid - CVE-2021-32985 It was * Not verifying digital signatures on data, or verifying them incorrectly - CVE-2021-32977. AVEVA System Platform is an application software of British AVEVA company. A responsive, standards-driven and scalable foundation for regulatory, enterprise SCADA, MES and IIoT applications. A security vulnerability exists in the AVEVA System Platform that could lead to a denial of service. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Trust: 2.7
AFFECTED PRODUCTS
| vendor: | aveva | model: | system platform | scope: | lt | version: | 2020 | Trust: 1.0 |
| vendor: | aveva | model: | system platform | scope: | eq | version: | 2020 | Trust: 1.0 |
| vendor: | aveva | model: | system platform | scope: | gte | version: | 2017 | Trust: 1.0 |
| vendor: | aveva | model: | system platform | scope: | eq | version: | 2017 to 2020 r2 p01 to | Trust: 0.8 |
| vendor: | aveva | model: | system platform | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-Other | Trust: 1.0 |
| problemtype: | CWE-248 | Trust: 1.0 |
| problemtype: | uncaught exception (CWE-248) [IPA evaluation ] | Trust: 0.8 |
| problemtype: | Lack of authentication for critical features (CWE-306) [IPA evaluation ] | Trust: 0.8 |
| problemtype: | Path traversal (CWE-22) [IPA evaluation ] | Trust: 0.8 |
| problemtype: | Same-origin policy violation (CWE-346) [IPA evaluation ] | Trust: 0.8 |
| problemtype: | Improper verification of digital signatures (CWE-347) [IPA evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
other
Trust: 1.2
PATCH
| title: | SECURITY BULLETIN AVEVA-2021-002 | url: | https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf | Trust: 0.8 |
| title: | AVEVA System Platform Security vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155676 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-33010 | Trust: 3.2 |
| db: | ICS CERT | id: | ICSA-21-180-05 | Trust: 2.4 |
| db: | JVN | id: | JVNVU90207343 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2021-001897 | Trust: 0.8 |
| db: | CS-HELP | id: | SB2021063022 | Trust: 0.6 |
| db: | AUSCERT | id: | ESB-2021.2281.2 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202106-1944 | Trust: 0.6 |
| db: | CS-HELP | id: | SB2021041363 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202104-975 | Trust: 0.6 |
REFERENCES
| url: | https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/securitybulletin_aveva-2021-002.pdf | Trust: 1.6 |
| url: | https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05 | Trust: 1.6 |
| url: | https://us-cert.cisa.gov/ics/advisories/icsa-21-180-05 | Trust: 1.4 |
| url: | http://jvn.jp/cert/jvnvu90207343 | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-33008 | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-33010 | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-32981 | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-32985 | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-32977 | Trust: 0.8 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.2281.2 | Trust: 0.6 |
| url: | https://cxsecurity.com/cveshow/cve-2021-33010/ | Trust: 0.6 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021063022 | Trust: 0.6 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021041363 | Trust: 0.6 |
CREDITS
Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
Trust: 0.6
SOURCES
| db: | JVNDB | id: | JVNDB-2021-001897 |
| db: | CNNVD | id: | CNNVD-202106-1944 |
| db: | CNNVD | id: | CNNVD-202104-975 |
| db: | NVD | id: | CVE-2021-33010 |
LAST UPDATE DATE
2024-08-14T13:14:50.020000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2021-001897 | date: | 2024-06-20T04:33:00 |
| db: | CNNVD | id: | CNNVD-202106-1944 | date: | 2022-04-14T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-14T00:00:00 |
| db: | NVD | id: | CVE-2021-33010 | date: | 2022-04-13T13:45:47.990 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2021-001897 | date: | 2021-07-01T00:00:00 |
| db: | CNNVD | id: | CNNVD-202106-1944 | date: | 2021-06-29T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-13T00:00:00 |
| db: | NVD | id: | CVE-2021-33010 | date: | 2022-04-04T20:15:09.370 |