Vulnerability-Lookup

FKIE_CVE-2021-32942

Vulnerability from fkie_nvd - Published: 2021-06-09 17:15 - Updated: 2026-06-17 03:53

Severity

6.6 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.

References

URL	Tags
ics-cert@hq.dhs.gov	https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03	Patch, Third Party Advisory, US Government Resource
ics-cert@hq.dhs.gov	https://www.aveva.com/en/support/cyber-security-updates/	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03	Patch, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.aveva.com/en/support/cyber-security-updates/	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
aveva	intouch_2017	-
aveva	intouch_2020	-
aveva	intouch_2020	r2

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "InTouch",
          "vendor": "AVEVA",
          "versions": [
            {
              "lessThanOrEqual": "2020 R2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ics-cert@hq.dhs.gov"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aveva:intouch_2017:-:update3:*:*:*:*:*:*",
              "matchCriteriaId": "3B981232-15DD-4AA5-9F13-5908BCC6E56B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:aveva:intouch_2020:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EADAE6E9-745F-4D31-8D30-AE0291E0E114",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:aveva:intouch_2020:r2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB4919BB-CBEA-4F32-B780-1F382C8934D1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad podr\u00eda exponer credenciales en texto sin cifrar de AVEVA InTouch Runtime 2020 R2 y todas las versiones anteriores (WindowViewer) si un usuario autorizado privilegiado crea un volcado de memoria de diagn\u00f3stico del proceso y lo guarda en una ubicaci\u00f3n no protegida"
    }
  ],
  "id": "CVE-2021-32942",
  "lastModified": "2026-06-17T03:53:50.570",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.2,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-09T17:15:07.737",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.aveva.com/en/support/cyber-security-updates/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.aveva.com/en/support/cyber-security-updates/"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-316"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-32942 (GCVE-0-2021-32942)

Vulnerability from cvelistv5 – Published: 2021-06-09 16:06 – Updated: 2024-09-17 03:17

Summary

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-316 - CLEARTEXT STORAGE OF SENSITIVE INFORMATION IN MEMORY CWE-316

Assigner

icscert icscert root

References

2 references

URL	Tags
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03	x_refsource_MISC
https://www.aveva.com/en/support/cyber-security-u…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AVEVA	InTouch	Affected: unspecified , ≤ 2020 R2 (custom)

Date Public

2021-06-08 00:00

Credits

Ilya Karpov, Evgeniy Druzhinin, and Konstantin Kondratev of Rostelecom-Solar reported this vulnerability to AVEVA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:33:55.966Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.aveva.com/en/support/cyber-security-updates/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InTouch",
          "vendor": "AVEVA",
          "versions": [
            {
              "lessThanOrEqual": "2020 R2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ilya Karpov, Evgeniy Druzhinin, and Konstantin Kondratev of Rostelecom-Solar reported this vulnerability to AVEVA."
        }
      ],
      "datePublic": "2021-06-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-316",
              "description": "CLEARTEXT STORAGE OF SENSITIVE INFORMATION IN MEMORY CWE-316",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-09T16:06:26.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aveva.com/en/support/cyber-security-updates/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "AVEVA recommends organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.\n\nUsers of InTouch 2020 R2 and all prior versions are affected and should first upgrade to one of the versions listed below, then apply the corresponding security update:\n\n    InTouch 2020 R2: Update to InTouch 2020 R2 P01\n\nInTouch 2020: Update to Security Update 1216934InTouch 2017 U3 SP1 P01: Update to Security Update 1216933"
        }
      ],
      "source": {
        "advisory": "ICSA-21-159-03 - AVEVA InTouch",
        "defect": [
          "CLEARTEXT",
          "STORAGE",
          "OF",
          "SENSITIVE",
          "INFORMATION",
          "IN",
          "MEMORY",
          "CWE-316"
        ],
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2021-06-08T00:00:00.000Z",
          "ID": "CVE-2021-32942",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "InTouch",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2020 R2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "AVEVA"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Ilya Karpov, Evgeniy Druzhinin, and Konstantin Kondratev of Rostelecom-Solar reported this vulnerability to AVEVA."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CLEARTEXT STORAGE OF SENSITIVE INFORMATION IN MEMORY CWE-316"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03",
              "refsource": "MISC",
              "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03"
            },
            {
              "name": "https://www.aveva.com/en/support/cyber-security-updates/",
              "refsource": "MISC",
              "url": "https://www.aveva.com/en/support/cyber-security-updates/"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "AVEVA recommends organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.\n\nUsers of InTouch 2020 R2 and all prior versions are affected and should first upgrade to one of the versions listed below, then apply the corresponding security update:\n\n    InTouch 2020 R2: Update to InTouch 2020 R2 P01\n\nInTouch 2020: Update to Security Update 1216934InTouch 2017 U3 SP1 P01: Update to Security Update 1216933"
          }
        ],
        "source": {
          "advisory": "ICSA-21-159-03 - AVEVA InTouch",
          "defect": [
            "CLEARTEXT",
            "STORAGE",
            "OF",
            "SENSITIVE",
            "INFORMATION",
            "IN",
            "MEMORY",
            "CWE-316"
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2021-32942",
    "datePublished": "2021-06-09T16:06:26.984Z",
    "dateReserved": "2021-05-13T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:17:35.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2021-32942

CVE-2021-32942 (GCVE-0-2021-32942)

Tags

Sightings

Nomenclature

Related by attack behaviour