CVE-2021-32942
Published Jun 9, 2021
Last updated 2 years ago
Overview
- Description
- The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
- Source
- ics-cert@hq.dhs.gov
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.5
- Impact score
- 3.6
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 2.1
- Impact score
- 2.9
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:P/I:N/A:N
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aveva:intouch_2017:-:update3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B981232-15DD-4AA5-9F13-5908BCC6E56B"
},
{
"criteria": "cpe:2.3:a:aveva:intouch_2020:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EADAE6E9-745F-4D31-8D30-AE0291E0E114"
},
{
"criteria": "cpe:2.3:a:aveva:intouch_2020:r2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB4919BB-CBEA-4F32-B780-1F382C8934D1"
}
],
"operator": "OR"
}
]
}
]