Vulnerability Description
A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openautomationsoftware | Open Automation Software | < 20.0.0.76 |
Related Weaknesses (CWE)
References
- https://openautomationsoftware.com/downloads/Product
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03US Government Resource
FAQ
What is CVE-2024-11220?
CVE-2024-11220 is a vulnerability with a CVSS score of 7.8 (HIGH). A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file o...
How severe is CVE-2024-11220?
CVE-2024-11220 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-11220?
Check the references section above for vendor advisories and patch information. Affected products include: Openautomationsoftware Open Automation Software.