Vulnerability-Lookup

GHSA-2J8G-W8GX-H43R

Vulnerability from github – Published: 2025-08-21 21:32 – Updated: 2025-08-21 21:32

Details

The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-54460"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-21T20:15:45Z",
    "severity": "HIGH"
  },
  "details": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to create or access publication targets of type Text \nFile or HDFS) to upload and persist files that could potentially be \nexecuted.",
  "id": "GHSA-2j8g-w8gx-h43r",
  "modified": "2025-08-21T21:32:07Z",
  "published": "2025-08-21T21:32:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54460"
    },
    {
      "type": "WEB",
      "url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-54460 (GCVE-0-2025-54460)

Vulnerability from cvelistv5 – Published: 2025-08-21 20:00 – Updated: 2025-08-21 20:13

Title

AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-434

Assigner

icscert

References

2 references

URL	Tags
https://www.aveva.com/content/dam/aveva/documents…
https://www.cisa.gov/news-events/ics-advisories/i…

Impacted products

1 product

Vendor	Product	Version
AVEVA	PI Integrator	Affected: 0 , < 2020 R2 SP1 (custom)

Credits

Maxime Escourbiac, Michelin CERT, and Adam Bertrand, Abicom for Michelin CERT reported these vulnerabilities to AVEVA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54460",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-21T20:12:55.514721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-21T20:13:06.036Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PI Integrator",
          "vendor": "AVEVA",
          "versions": [
            {
              "lessThan": "2020 R2 SP1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Maxime Escourbiac, Michelin CERT, and Adam Bertrand, Abicom for Michelin CERT reported these vulnerabilities to AVEVA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to create or access publication targets of type Text \nFile or HDFS) to upload and persist files that could potentially be \nexecuted."
            }
          ],
          "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to create or access publication targets of type Text \nFile or HDFS) to upload and persist files that could potentially be \nexecuted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-21T20:00:11.036Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.\u003c/li\u003e\n\u003cli\u003eFrom [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\n\n\n\n  *  Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.\n\n  *  From [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher."
        }
      ],
      "source": {
        "advisory": "ICSA-25-224-04",
        "discovery": "EXTERNAL"
      },
      "title": "AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAdditionally, AVEVA recommends the following general defensive measures:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAudit assigned permissions to ensure that only trusted users are given access rights to publication targets: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html\"\u003ehttps://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eEnsure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:\u003c/li\u003e\n\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\"\u003ehttps://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\u003c/a\u003e\u003c/li\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\"\u003ehttps://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023009.html\u003c/a\u003eConsider applying Windows Defender Application Control (WDAC) to prevent execution of unauthorized executables: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager\"\u003ehttps://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager\u003c/a\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Additionally, AVEVA recommends the following general defensive measures:\n\n\n\n  *  Audit assigned permissions to ensure that only trusted users are given access rights to publication targets:  https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html \n\n\n  *  Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:\n\n  *   https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html \n https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2025-54460",
    "datePublished": "2025-08-21T20:00:11.036Z",
    "dateReserved": "2025-07-31T16:41:30.389Z",
    "dateUpdated": "2025-08-21T20:13:06.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2J8G-W8GX-H43R

CVE-2025-54460 (GCVE-0-2025-54460)

Tags

Sightings

Nomenclature