CVE-2024-3468: Deserialization of Untrusted Data in AVEVA PI Web API

Published Jun 12, 2024

Updated

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

Affected Software

1 affected component

AVEVA PI Web API

Remediation

Information

AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible: From OSI Soft Customer Portal https://my.osisoft.com/ , search for "PI Web API" and select version "2023 SP1" or later. (Alternative) PI Web API 2021 SP3 can be fixed by upgrading PI AF Client to one of the versions specified in AVEVA Security Bulletin AVEVA-2024-004 / ICSA-24-163-03 AVEVA further recommends users follow general defensive measures: * Set "DisableWrites" configuration setting to true, if this instance of PI Web API is used only for reading data or GET requests. * Uninstall Core Endpoints feature if this instance of PI Web API is used only for data collection from AVEVA Adapters. Keep OMF feature installed. * Limit AF Servers' Administrators, so that most of the PI Web API user accounts don't have the permission to change the backend AF servers. For additional information please refer to AVEVA-2024-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/

Event History

Jun 12, 2024

CVE Published

via MITRE·09:04 PM

Data Sourced

via MITRE·09:04 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-3468?

CVE-2024-3468 has a medium severity rating due to the potential for unauthorized code execution.

How do I fix CVE-2024-3468?

To fix CVE-2024-3468, ensure that users are educated on safe API usage and implement access controls to limit the API XML import functionality.

What are the potential impacts of CVE-2024-3468?

The potential impacts of CVE-2024-3468 include unauthorized code execution and possible compromise of the PI Web API environment.

Who is affected by CVE-2024-3468?

Organizations using AVEVA PI Web API are affected by CVE-2024-3468, particularly if interactive users engage with the API XML import functionality.

Is there a way to mitigate the risks associated with CVE-2024-3468?

Yes, mitigating risks from CVE-2024-3468 involves user training, implementing input validation, and strengthening user permissions.