This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
References
| Link | Resource |
|---|---|
| https://www.aveva.com/en/support-and-success/cyber-security-updates/ | Vendor Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 | Third Party Advisory US Government Resource |
| https://www.aveva.com/en/support-and-success/cyber-security-updates/ | Vendor Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.aveva.com/en/support-and-success/cyber-security-updates/ - Vendor Advisory | |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 - Third Party Advisory, US Government Resource |
08 Dec 2023, 17:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Aveva intouch
Aveva batch Management Aveva historian Aveva mobile Operator Aveva communication Drivers Aveva edge Aveva manufacturing Execution System Aveva telemetry Server Aveva plant Scada Aveva recipe Management Aveva enterprise Licensing Aveva Aveva work Tasks Aveva system Platform |
|
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 - Third Party Advisory, US Government Resource | |
| References | () https://www.aveva.com/en/support-and-success/cyber-security-updates/ - Vendor Advisory | |
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:a:aveva:plant_scada:2020:r2:*:*:*:*:*:* cpe:2.3:a:aveva:plant_scada:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:mobile_operator:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:historian:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:mobile_operator:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:mobile_operator:2020:*:*:*:*:*:*:* cpe:2.3:a:aveva:system_platform:2020:r2_p01:*:*:*:*:*:* cpe:2.3:a:aveva:work_tasks:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:historian:2020:r2:*:*:*:*:*:* cpe:2.3:a:aveva:communication_drivers:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:work_tasks:2020:update_2:*:*:*:*:*:* cpe:2.3:a:aveva:communication_drivers:2020:r2_p01:*:*:*:*:*:* cpe:2.3:a:aveva:intouch:2020:r2:*:*:*:*:*:* cpe:2.3:a:aveva:system_platform:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:batch_management:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:historian:2020:r2_p01:*:*:*:*:*:* cpe:2.3:a:aveva:historian:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:work_tasks:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:recipe_management:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:manufacturing_execution_system:2020:p01:*:*:*:*:*:* cpe:2.3:a:aveva:plant_scada:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:telemetry_server:2020r2:sp1:*:*:*:*:*:* cpe:2.3:a:aveva:work_tasks:2020:update_1:*:*:*:*:*:* cpe:2.3:a:aveva:mobile_operator:2020:r1:*:*:*:*:*:* cpe:2.3:a:aveva:batch_management:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:manufacturing_execution_system:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:recipe_management:2020:update_1_patch_2:*:*:*:*:*:* cpe:2.3:a:aveva:system_platform:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:batch_management:2020:sp1:*:*:*:*:*:* cpe:2.3:a:aveva:recipe_management:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:communication_drivers:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:communication_drivers:2020:r2:*:*:*:*:*:* cpe:2.3:a:aveva:manufacturing_execution_system:2020:*:*:*:*:*:*:* cpe:2.3:a:aveva:edge:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:enterprise_licensing:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:system_platform:2020:r2:*:*:*:*:*:* cpe:2.3:a:aveva:intouch:2020:-:*:*:*:*:*:* cpe:2.3:a:aveva:intouch:*:*:*:*:*:*:*:* cpe:2.3:a:aveva:telemetry_server:2020r2:-:*:*:*:*:*:* cpe:2.3:a:aveva:intouch:2020:r2_p01:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
15 Nov 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-15 17:15
Updated : 2024-11-21 08:06
NVD link : CVE-2023-33873
Mitre link : CVE-2023-33873
CVE.ORG link : CVE-2023-33873
JSON object : View
Products Affected
aveva
- system_platform
- work_tasks
- manufacturing_execution_system
- plant_scada
- telemetry_server
- historian
- edge
- communication_drivers
- recipe_management
- enterprise_licensing
- batch_management
- intouch
- mobile_operator
CWE