CVE-2024-6456 — SQL Injection vulnerability in AVEVA Historian Server

CVE-2024-6456

SQL Injection vulnerability in AVEVA Historian Server PUBLISHED

Description (CNA)

AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL.

Affected (CNA)

Vendor / product	Versions
AVEVA / Historian Web Server	affected 2023R2; affected 2023 before 2023 P03; affected 2020 before 2020 R2 SP1 P01

CWE

CWE-89

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-10

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.