ICSA-24-319-13

icsaUScisa_csaf_ot

Rockwell Automation Verve Reporting (Update A)

view advisory published 2024-11-14

Successful exploitation of this vulnerability could lead to arbitrary code execution.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2024-37287UShigh7.2—
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can…
02

references

External citations — patches, advisories, analysis.

03

remediations (2)

  • MitigationVerve Reporting

    Access to the built-in "verve" account should be limited to only administrators who need to perform administrative functions and should only be used for administrative purposes. Separate accounts should be used for day-to-day functions.

  • FixedVerve Reporting

    Disable Machine Learning *-* Machine learning can be disabled in the Elasticsearch configuration override. Contact Verve support for assistance if needed. *-* Connect to the Reporting server via SSH or terminal. *-* Copy the Elasticsearch configuration override to the working directory. *-* docker exec $(docker ps --filter "name=Reporting_elasticsearch" --format "{{ .ID }}") cat /usr/share/elasticsearch/config-templates/elasticsearch.override.yml > elasticsearch.override.yml *-* *-* *-* Add the following line and save. *-* xpack.ml.enabled: false *-* *-* *-* Disable Verve Reporting from the Verve Software Manager. *-* Update the Elasticsearch configuration override. *-* docker config rm elasticsearchymloverride *-* docker config create elasticsearchymloverride ./elasticsearch.override.yml *-* *-* *-* Enable Verve Reporting from the Verve Software Manager and confirm that the application starts and "Machine Learning" is no longer listed in the main navigation bar under Analytics. *-* Delete the copy of the Elasticsearch configuration override. *-* rm elasticsearch.override.yml

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan