7.1
CVE-2020-9049
- EPSS 0.06%
- Veröffentlicht 19.11.2020 16:15:11
- Zuletzt bearbeitet 21.11.2024 05:39:54
- Quelle productsecurity@jci.com
- CVE-Watchlists
- Unerledigt
LoginA vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Johnsoncontrols ≫ C-cure Web Version <= 2.90
Johnsoncontrols ≫ Victor Web Version <= 5.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.16 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 1.6 | 3.6 |
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5.7 | 5.5 | 6.9 |
AV:A/AC:M/Au:N/C:N/I:N/A:C
|
| productsecurity@jci.com | 7.1 | 1.6 | 5.5 |
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
|
CWE-285 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.