Critical ICSA-22-342-02 3 CVEs

AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere

Published Dec 8, 2022 · Updated Apr 3, 2023 · Revision 2

Vendor: AVEVA Product: InTouch Access Anywhere Product: Plant SCADA Access Anywhere

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-22-342-02 AVEVA InTouch Access Anywhere, published December 8, 2022 on the ICS webpage at cisa.gov/topics/industrial-control-systems.

Vulnerabilities 3

Critical 9.8

CVE-2021-3711 Public exploit EPSS 88%

SM2 Decryption Buffer Overflow

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

Aug 24, 2021
High 7.5

CVE-2022-23854 Public exploit Scanner template EPSS 50%

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an…

AVEVA InTouch Access Anywhere

Dec 23, 2022
Medium 6.9

CVE-2020-11022 Public exploit EPSS 99%

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems

Apr 29, 2020

Revision history

2023-04-03 #2
CSAF Update Date
2022-12-08 #1
Previous Publication Date

References

ICS Advisory ICSA-22-342-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/ics/Recommended-Practices
Recommended Practices
https://cisa.gov/ics