GHSA-4cvp-hr63-822j: Exposure of Sensitive Information in OPC UA .NET Standard Reference Server

Skip to content

Sign up

CVE-2023-31048

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

Explore

*   All features
*   Documentation
*   GitHub Skills
*   Blog

• For

  • Enterprise
  • Teams
  • Startups
  • Education

  By Solution

  • CI/CD & Automation
  • DevOps
  • DevSecOps

  Case Studies

  • Customer Stories
  • Resources

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

Repositories

*   Topics
*   Trending
*   Collections

• Pricing

• Search All GitHub

• No suggested jump to results

• Search All GitHub

• Search All GitHub

• Search All GitHub

Sign in

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-31048

Exposure of Sensitive Information in OPC UA .NET Standard Reference Server

Moderate severity GitHub Reviewed Published May 4, 2023 in OPCFoundation/UA-.NETStandard • Updated May 5, 2023

Vulnerability details Dependabot alerts 0

Package

nuget OPCFoundation.NetStandard.Opc.Ua.Core (NuGet)

Affected versions

< 1.4.371.86

Patched versions

1.4.371.86

nuget OPCFoundation.NetStandard.Opc.Ua.Server (NuGet)

< 1.4.371.86

1.4.371.86

Description

This security update resolves a vulnerability in the OPC UA .NET Standard Reference Server that allows
remote attackers to send malicious requests that expose sensitive information.

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-31048.pdf

References

• GHSA-4cvp-hr63-822j

opcfoundation-org published to OPCFoundation/UA-.NETStandard

May 4, 2023

Published to the GitHub Advisory Database

May 5, 2023

Reviewed

May 5, 2023

Last updated

May 5, 2023

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-200

CVE ID

CVE-2023-31048

GHSA ID

GHSA-4cvp-hr63-822j

Source code

OPCFoundation/UA-.NETStandard

Checking history

See something to contribute? Suggest improvements for this vulnerability.