What is the severity of CVE-2021-42797?

CVE-2021-42797 is considered a critical vulnerability due to its potential to allow unauthorized access to sensitive data by stealing Windows access tokens.

How do I fix CVE-2021-42797?

To fix CVE-2021-42797, upgrade your AVEVA Edge software to a version released after R2020, which address this vulnerability.

What versions of AVEVA Edge are affected by CVE-2021-42797?

CVE-2021-42797 affects AVEVA Edge versions R2020 and all previous versions, including InduSoft Web Studio.

What are the potential consequences of CVE-2021-42797?

The exploitation of CVE-2021-42797 could lead to unauthorized access to external database resources and exposure of sensitive user credentials.

Who is at risk from CVE-2021-42797?

Organizations using affected versions of AVEVA Edge are at risk, particularly those that connect to external databases without proper access controls.

Vulnerability/
CVE-2021-42797

high

8.6

CWE

22 40

16/12/2023

4/8/2024

CVE-2021-42797: Path Traversal

First published: Sat Dec 16 2023(Updated: )

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
AVEVA Edge
AVEVA Edge 2020 R2 SP1
AVEVA InduSoft Web Studio
AVEVA Edge 2020 R2 SP1	<2020
AVEVA Edge 2020 R2 SP1	=2020
AVEVA Edge 2020 R2 SP1	=2020-r2
AVEVA Edge 2020 R2 SP1	=2020-r2

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

ICSA-22-326-01

Frequently Asked Questions

What is the severity of CVE-2021-42797?
CVE-2021-42797 is considered a critical vulnerability due to its potential to allow unauthorized access to sensitive data by stealing Windows access tokens.
How do I fix CVE-2021-42797?
To fix CVE-2021-42797, upgrade your AVEVA Edge software to a version released after R2020, which address this vulnerability.
What versions of AVEVA Edge are affected by CVE-2021-42797?
CVE-2021-42797 affects AVEVA Edge versions R2020 and all previous versions, including InduSoft Web Studio.
What are the potential consequences of CVE-2021-42797?
The exploitation of CVE-2021-42797 could lead to unauthorized access to external database resources and exposure of sensitive user credentials.
Who is at risk from CVE-2021-42797?
Organizations using affected versions of AVEVA Edge are at risk, particularly those that connect to external databases without proper access controls.

agent/references
agent/type
agent/first-publish-date
agent/author
agent/severity
agent/description
agent/event
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/weakness
agent/last-modified-date
agent/trending
agent/source
agent/tags
collector/ics-cert-advisory
source/ICS
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/nvd-api
vendor/aveva
canonical/aveva edge
canonical/aveva edge 2020 r2 sp1
canonical/aveva indusoft web studio
version/aveva edge 2020 r2 sp1/2020
version/aveva edge 2020 r2 sp1/2020-r2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.