01 Record

CVE-2023-31274

Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server

MediumPUBLISHEDCNA: icscert

CNA base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

View raw JSON

02 Description

Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.50% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 42.6% of scored records. A rank, not a probability.

NVD base score

5.3 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-01-18 17:15Z2 YR AGO

Last updated

2024-08-29 20:02Z2 YR AGO

Reserved

2023-07-12

Assigning CNA

icscert

Record state

PUBLISHED

Severity

Medium (CVSS 5.3)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-772Missing Release of Resource after Effective LifetimeBase

Data version

5.1

Document digest

4569f7f82bed3519a8c37bf133f62e9072254fe64fa68852605b80f038dc9f33

05 Affected products

VendorProductVersionsPlatforms

AvevaPI Server2023, 0 to 2018 SP3 P05—

06 References

www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01government-resource

07 Remediation

All affected versions can be fixed by upgrading to AVEVA PI Server version 2023 Patch 1 or later. From OSI Soft Customer Portal https://my.osisoft.com/ , search for “PI Server” and select version “2023 Patch 1”. For an alternative fix, AVEVA PI Server 2018 SP3 Patch 5 and prior can be fixed by deploying AVEVA PI Server version 2018 SP3 Patch 6 or later. From OSI Soft Customer Portal https://my.osisoft.com/ , search for “PI Server” and select version “2018 SP3 Patch 6”. AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected products should apply security updates as soon as possible. AVEVA recommends the following defensive measures: * Set the PI Message Subsystem to auto restart. * Monitor the memory usage of the PI Message Subsystem. * Limit network access to port 5450 to trusted workstations and software * Confirm that only authorized users have access to write to the PI Server Message Log. This is done through configuration of the PIMSGSS entry within the Database Security plugin accessible through PI System Management Tools. For more information on this vulnerability, including security updates, users should see security bulletin AVEVA-2024-001 https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2024-001.pdf .