CVE-2024-6456: SQL Injection vulnerability in AVEVA Historian Server

Published Aug 15, 2024

Updated

AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL.

Affected Software

1 affected component

AVEVA Historian Server

Remediation

Information

AVEVA recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Users with affected product versions should apply security updates as soon as possible. AVEVA recommends Historian is upgraded by AVEVA System Platform media: * (Recommended) All affected versions can be fixed by upgrading to AVEVA System Platform 2023 R2 P01 https://softwaresupportsp.aveva.com/#/producthub/details * (Alternative 1) Historian 2023 through 2023 P03 can be fixed by upgrading to AVEVA System Platform 2023 P04 https://softwaresupportsp.aveva.com/#/producthub/details * (Alternative 2) Historian 2020 R2 through 2020 R2 SP1 P01 can be fixed by first upgrading to AVEVA System Platform 2020 R2 SP1 P01 and then applying Hotfix 3190476. Please contact AVEVA Global Customer Support https://www.aveva.com/en/support/support-contact/ for instructions on how to download and apply this security fix. AVEVA also recommends the following general defensive measures: * Establish procedures for Historian REST Interface users to verify the source of URLs shared with them is trusted before opening. For information on how to reach AVEVA support for your product, please refer to this link: AVEVA Customer Support https://www.aveva.com/en/support/support-contact/ . If you discover errors or omissions in this advisory, please report the finding to Support. For the latest AVEVA security information and security updates, please visit AVEVA Security Central https://softwaresupportsp.aveva.com/#/securitycentral . Aveva recommends users looking for general information regarding how to secure Industrial Control Systems reference the NIST Guide to Operational Technology (OT) Security, NIST SP800-82r3 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf . For more information, see AVEVA's Security Bulletin AVEVA-2024-005. https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2024-005.pdf

Event History

Aug 15, 2024

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-6456?

CVE-2024-6456 is considered a high-severity vulnerability due to the potential for SQL injection and escalation of privileges.

How do I fix CVE-2024-6456?

To address CVE-2024-6456, update to the latest version of AVEVA Historian Server as provided by the vendor.

What are the potential impacts of CVE-2024-6456?

Exploitation of CVE-2024-6456 could allow an attacker to execute malicious SQL commands and gain unauthorized access to sensitive data.

Who is affected by CVE-2024-6456?

CVE-2024-6456 affects users of AVEVA Historian Server, specifically those using the Historian REST Interface.

What kind of attack is associated with CVE-2024-6456?

CVE-2024-6456 is associated with social engineering attacks that trick users into opening specially crafted URLs.