9.8
CVE-2020-24683
- EPSS 0.45%
- Published 22.12.2020 22:15:13
- Last modified 21.11.2024 05:15:46
- Source cybersecurity@ch.abb.com
- Teams watchlist Login
- Open Login
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
Data is provided by the National Vulnerability Database (NVD)
Abb ≫ Symphony + Historian Version3.0
Abb ≫ Symphony + Historian Version3.1
Abb ≫ Symphony + Operations Version1.1
Abb ≫ Symphony + Operations Version2.0
Abb ≫ Symphony + Operations Version2.1 Updatesp1
Abb ≫ Symphony + Operations Version2.1 Updatesp2
Abb ≫ Symphony + Operations Version3.0
Abb ≫ Symphony + Operations Version3.1
Abb ≫ Symphony + Operations Version3.2
Abb ≫ Symphony + Operations Version3.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.45% | 0.609 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| cybersecurity@ch.abb.com | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-305 Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CWE-602 Client-Side Enforcement of Server-Side Security
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-669 Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.