Security Update for the OPC UA .NET Standard Reference Server

Moderate

opcfoundation-org published GHSA-4cvp-hr63-822j

May 4, 2023

Package

OPCFoundation.NetStandard.Opc.Ua.Core (NuGet)

Affected versions

<1.4.371.86

Patched versions

1.4.371.86

OPCFoundation.NetStandard.Opc.Ua.Server (NuGet)

<1.4.371.86

1.4.371.86

Description

This security update resolves a vulnerability in the OPC UA .NET Standard Reference Server that allows
remote attackers to send malicious requests that expose sensitive information.

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-31048.pdf

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N