CVE-2023-33873— AVEVA Operations Control Logger 安全漏洞
一分钟漏洞结论
影响对象
AVEVA SystemPlatform
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
AVEVA Operations Control Logger是英国剑维软件（AVEVA）公司的一个控制中心。提供跨本地和云应用程序的访问。 AVEVA Operations Control Logger存在安全漏洞，该漏洞源于存在权限升级漏洞，经过身份验证的用户可以升级系统权限，从而导致目标计算机完全受到损害。
可能的 ATT&CK 技术 1 AI
T1068 · Exploitation for Privilege Escalation
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2023-33873 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
AVEVA Operations Control Logger Execution with Unnecessary Privileges
来源: CVE Program / CVE List V5
Vulnerability Description
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
带着不必要的权限执行
来源: CVE Program / CVE List V5
Vulnerability Title
AVEVA Operations Control Logger 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
AVEVA Operations Control Logger是英国剑维软件（AVEVA）公司的一个控制中心。提供跨本地和云应用程序的访问。 AVEVA Operations Control Logger存在安全漏洞，该漏洞源于存在权限升级漏洞，经过身份验证的用户可以升级系统权限，从而导致目标计算机完全受到损害。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| AVEVA | SystemPlatform | 0 ~ 2020 R2 SP1 P01 | - |
|
| AVEVA | Historian | 0 ~ 2020 R2 SP1 P01 | - |
|
| AVEVA | Application Server | 0 ~ 2020 R2 SP1 P01 | - |
|
| AVEVA | InTouch | 0 ~ 2020 R2 SP1 P01 | - |
|
| AVEVA | Enterprise Licensing (formerly known as License Manager) | 0 ~ 3.7.002 | - |
|
| AVEVA | Manufacturing Execution System (formerly known as Wonderware MES) | 0 ~ 2020 P01 | - |
|
| AVEVA | Recipe Management | 0 ~ 2020 R2 Update 1 Patch 2 | - |
|
| AVEVA | Batch Management | 0 ~ 2020 SP1 | - |
|
| AVEVA | Edge (formerly known as Indusoft Web Studio) | 0 ~ 2020 R2 SP1 P01 | - |
|
| AVEVA | Worktasks (formerly known as Workflow Management) | 0 ~ 2020 U2 | - |
|
| AVEVA | Plant SCADA (formerly known as Citect) | 0 ~ 2020 R2 Update 15 | - |
|
| AVEVA | Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds) | 0 ~ 2020 R1 | - |
|
| AVEVA | Communication Drivers Pack | 0 ~ 2020 R2 SP1 | - |
|
| AVEVA | Telemetry Server | 0 ~ 2020 R2 SP1 | - |
|
二、漏洞 CVE-2023-33873 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2023-33873 的情报信息
请登录查看更多情报信息。
CVE-2023-33873 厂商安全公告 (1)
IV. Related Vulnerabilities
Same vendor: AVEVA
V. Comments for CVE-2023-33873
暂无评论