CVE-2023-34317

PoC ×2—

CVSS 3.1

6.5 medium

EPSS

<1%p57

Published

Sep 5, 2023 (Sep 5, 2023)

Modified

Jun 17, 2026

Description

An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.

Vendors: openautomationsoftware
Products: oas platform
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges

Cisco TalosJan 31, 17:00 UTC · Jan 31, 2024Vulnerability CVE-2023-31242 CVE-2023-34998 CVE-2023-32615+2 CVEs

Eight vulnerabilities in Open Automation Software Platform could lead to information disclosure, improper authentication

Cisco TalosSep 6, 16:47 UTC · Sep 6, 2023Vulnerability CVE-2023-35124 CVE-2023-34353 CVE-2023-32271+5 CVEs