Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2024-3468

Deserialization of Untrusted Data in AVEVA PI Web API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AVEVA PI Web API

Default version status: unaffected

  • 0 to ≤ 2023affected

References