Required CVE Record Information
Description
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
CVSS 1 Total
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.6 | MEDIUM | 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Credits
- Ilya Karpov, Evgeniy Druzhinin, and Konstantin Kondratev of Rostelecom-Solar reported this vulnerability to AVEVA.
Updated:
This container includes required additional information provided by the CVE Program for this vulnerability.
References 2 Total
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03 x_transferred
- https://www.aveva.com/en/support/cyber-security-updates/ x_transferred