CVE-2021-38410: aveva batch management +6 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-38410

CVSS 7.8 · High EPSS 0,22%

Kerentanan Uncontrolled Search Path Element pada aveva batch management, aveva enterprise data management +5 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.

Rincian

Terbit di NVD: 27 Juli 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-427: Uncontrolled Search Path Element
EPSS (30 hari): 0,22% peluang dieksploitasi; lebih tinggi dari 11,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
aveva	batch management	Versi 2020
aveva	enterprise data management	Versi 2020
aveva	manufacturing execution system	Versi 2020
aveva	mobile operator	Versi 2020
aveva	platform common services	Versi 4.4.6
aveva	platform common services	Versi 4.5.0
aveva	platform common services	Versi 4.5.1
aveva	platform common services	Versi 4.5.2
aveva	system platform	Versi 2020
aveva	system platform	Versi 2020 r2
aveva	system platform	Versi 2020 r2_p01
aveva	work tasks	Versi 2020
aveva	work tasks	Versi 2020 update_1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.aveva.com/en/support-and-success/cyber-security-updates/ advisory vendor
https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01 advisory pihak ketiga · pemerintah AS

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.