Rockwell Automation Verve Reporting (Update A)
Successful exploitation of this vulnerability could lead to arbitrary code execution.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-37287US | high7.2 | — | ||
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-319-13 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-319-13 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- MitigationVerve Reporting
Access to the built-in "verve" account should be limited to only administrators who need to perform administrative functions and should only be used for administrative purposes. Separate accounts should be used for day-to-day functions.
- FixedVerve Reporting
Disable Machine Learning *-* Machine learning can be disabled in the Elasticsearch configuration override. Contact Verve support for assistance if needed. *-* Connect to the Reporting server via SSH or terminal. *-* Copy the Elasticsearch configuration override to the working directory. *-* docker exec $(docker ps --filter "name=Reporting_elasticsearch" --format "{{ .ID }}") cat /usr/share/elasticsearch/config-templates/elasticsearch.override.yml > elasticsearch.override.yml *-* *-* *-* Add the following line and save. *-* xpack.ml.enabled: false *-* *-* *-* Disable Verve Reporting from the Verve Software Manager. *-* Update the Elasticsearch configuration override. *-* docker config rm elasticsearchymloverride *-* docker config create elasticsearchymloverride ./elasticsearch.override.yml *-* *-* *-* Enable Verve Reporting from the Verve Software Manager and confirm that the application starts and "Machine Learning" is no longer listed in the main navigation bar under Analytics. *-* Delete the copy of the Elasticsearch configuration override. *-* rm elasticsearch.override.yml
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan