CVE-2019-6545: aveva indusoft_web_studio Resource Injection

Vulnerability summary

CVE-2019-6545 is a high (CVSS 7.5) Resource Injection vulnerability in aveva indusoft_web_studio. EPSS estimates a 13.86% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-02-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server machine.

• CWE-99Improper Control of Resource Identifiers ('Resource Injection')The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.