9.8

CVE-2020-24683

Authentication Bypass in Symphony Plus

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Abb ≫ Symphony + Historian Version 3.0
Abb ≫ Symphony + Historian Version 3.1
Abb ≫ Symphony + Operations Version 1.1
Abb ≫ Symphony + Operations Version 2.0
Abb ≫ Symphony + Operations Version 2.1 Update sp1
Abb ≫ Symphony + Operations Version 2.1 Update sp2
Abb ≫ Symphony + Operations Version 3.0
Abb ≫ Symphony + Operations Version 3.1
Abb ≫ Symphony + Operations Version 3.2
Abb ≫ Symphony + Operations Version 3.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.46% 0.705
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
cybersecurity@ch.abb.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-305 Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

CWE-602 Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

CWE-669 Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
Vendor Advisory
Mitigation