Description
The vulnerability, if exploited, could allow an authenticated miscreant
(with privilege of "aaConfigTools") to tamper with App Objects' help
files and persist a cross-site scripting (XSS) injection that when
executed by a victim user, can result in horizontal or vertical
escalation of privileges. The vulnerability can only be exploited during
config-time operations within the IDE component of Application Server.
Run-time components and operations are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AVEVA | Application Server | ≤ Versions 2023 R2 SP1 P02 | — |
Advisories 1
- ICSA-25-317-02 AVEVA Application Server IDE CISA ICS & IT advisories · Nov 13, 2025