1. EXECUTIVE SUMMARY
- CVSS v4 7.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: AVEVA
- Equipment: PI Integrator
- Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Insertion of Sensitive Information into Sent Data
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, or upload and execute files.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following AVEVA products are affected:
- PI Integrator for Business Analytics: Versions 2020 R2 SP1 and prior.
3.2 VULNERABILITY OVERVIEW
3.2.1 UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed.
CVE-2025-54460 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L).
A CVSS v4 score has also been calculated for CVE-2025-54460. A base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:H/SI:H/SA:H).
3.2.2 INSERTION OF SENSITIVE INFORMATION INT
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
This article has been indexed from All CISA Advisories
Read the original article:
Read the original article: