title: AVEVA PCS Portal Uncontrolled Search Path Element
description: AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.
problem types: CVE-427
affected:
{
product: Platform Common Services (PCS) Portal
vendor: AVEVA
versions:
status: affected, version: 4.5.2
status: affected, version: 4.5.1
status: affected, version: 4.5.0
status: affected, version: 4.4.6
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: AVEVA recommends organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Users of affected versions of the products should apply the corresponding security update as soon as possible.
Security update PCS 4.5.3 is available for the following versions:
AVEVA Mobile Operator 2020
AVEVA Enterprise Data Management 2021
AVEVA System Platform 2020 R2 P01
AVEVA System Platform 2020 R2
AVEVA Work Tasks 2020 Update 1
Security update PCS 4.4.7 is available for the following versions:
AVEVA System Platform 2020
AVEVA Work Tasks 2020
AVEVA Manufacturing Execution System 2020
AVEVA Batch Management 2020
For more information on this issue, including security updates, please see Security Bulletin AVEVA-2021-008.