CVE-2024-11220CWE-279

Open Automation Software Incorrect Execution-Assigned Permissions

High · published December 6, 2024

CVSS v4.0
8.5
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-279 · Incorrect Execution-Assigned Permissions
Published
2024-12-06T17:45Z
EPSS history
Timeline
  • 06 DEC 17:45Z
    Open Automation Software Incorrect Execution-Assigned Permissions
    cvelistv5