CVE-2024-3468

HIGH

AVEVA PI Web API < 2023 - Remote Code Execution via API XML Import

Title source: llm
STIX 2.1

Description

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-163-02

Scores

CVSS v4 8.4
EPSS 0.0042
EPSS Percentile 33.2%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-502
Status published
Products (1)
AVEVA/PI Web API < 2023
Published Jun 12, 2024
Tracked Since Feb 18, 2026