CVE:CVE-2021-38410
CNNVD:CNNVD-202109-449
AVEVA System Platform是英国AVEVA公司的一个应用软件。用于监管、企业 SCADA、MES 和 IIoT 应用程序的响应迅速、标准驱动且可扩展的基础。
AVEVA System Platform Common Services (PCS) Portal 存在代码问题漏洞，该漏洞源于通过不受控制的搜索路径元素，受影响的产品容易受到 DLL 劫持，这可能允许攻击者控制搜索路径中的一个或多个位置。
solution:Upgrade aveva batch_management to a higher version than 2020,and avoid the version 2020; Upgrade aveva enterprise_data_management to a higher version than 2020,and avoid the version 2020; Upgrade aveva manufacturing_execution_system to a higher version than 2020,and avoid the version 2020; Upgrade aveva mobile_operator to a higher version than 2020,and avoid the version 2020; Upgrade aveva platform_common_services to a higher version than 4.4.6,4.5.0,4.5.1,4.5.2,and avoid the version 4.4.6,4.5.0,4.5.1,4.5.2; Upgrade aveva system_platform to a higher version than 2020,2020:r2,2020:r2_p01,and avoid the version 2020,2020:r2,2020:r2_p01; Upgrade aveva work_tasks to a higher version than 2020,2020:update_1,and avoid the version 2020,2020:update_1