This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Batch_management | Aveva | * | 2020 (excluding) |
| Batch_management | Aveva | 2020 (including) | 2020 (including) |
| Batch_management | Aveva | 2020-sp1 (including) | 2020-sp1 (including) |
| Communication_drivers | Aveva | * | 2020 (excluding) |
| Communication_drivers | Aveva | 2020 (including) | 2020 (including) |
| Communication_drivers | Aveva | 2020-r2 (including) | 2020-r2 (including) |
| Communication_drivers | Aveva | 2020-r2_p01 (including) | 2020-r2_p01 (including) |
| Edge | Aveva | * | 20.1.101 (including) |
| Enterprise_licensing | Aveva | * | 3.7.002 (including) |
| Historian | Aveva | * | 2020 (excluding) |
| Historian | Aveva | 2020 (including) | 2020 (including) |
| Historian | Aveva | 2020-r2 (including) | 2020-r2 (including) |
| Historian | Aveva | 2020-r2_p01 (including) | 2020-r2_p01 (including) |
| Intouch | Aveva | * | 2020 (excluding) |
| Intouch | Aveva | 2020 (including) | 2020 (including) |
| Intouch | Aveva | 2020-r2 (including) | 2020-r2 (including) |
| Intouch | Aveva | 2020-r2_p01 (including) | 2020-r2_p01 (including) |
| Manufacturing_execution_system | Aveva | * | 2020 (excluding) |
| Manufacturing_execution_system | Aveva | 2020 (including) | 2020 (including) |
| Manufacturing_execution_system | Aveva | 2020-p01 (including) | 2020-p01 (including) |
| Mobile_operator | Aveva | * | 2020 (excluding) |
| Mobile_operator | Aveva | 2020 (including) | 2020 (including) |
| Mobile_operator | Aveva | 2020-r1 (including) | 2020-r1 (including) |
| Plant_scada | Aveva | * | 2020 (excluding) |
| Plant_scada | Aveva | 2020 (including) | 2020 (including) |
| Plant_scada | Aveva | 2020-r2 (including) | 2020-r2 (including) |
| Recipe_management | Aveva | * | 2020 (excluding) |
| Recipe_management | Aveva | 2020 (including) | 2020 (including) |
| Recipe_management | Aveva | 2020-update_1_patch_2 (including) | 2020-update_1_patch_2 (including) |
| System_platform | Aveva | * | 2020 (excluding) |
| System_platform | Aveva | 2020 (including) | 2020 (including) |
| System_platform | Aveva | 2020-r2 (including) | 2020-r2 (including) |
| System_platform | Aveva | 2020-r2_p01 (including) | 2020-r2_p01 (including) |
| Telemetry_server | Aveva | 2020r2 (including) | 2020r2 (including) |
| Telemetry_server | Aveva | 2020r2-sp1 (including) | 2020r2-sp1 (including) |
| Work_tasks | Aveva | * | 2020 (excluding) |
| Work_tasks | Aveva | 2020 (including) | 2020 (including) |
| Work_tasks | Aveva | 2020-update_1 (including) | 2020-update_1 (including) |
| Work_tasks | Aveva | 2020-update_2 (including) | 2020-update_2 (including) |