CVE-2020-24683

Published Dec 22, 2020

Last updated 3 years ago

CVSS critical 9.8

Overview

Description: The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
Source: cybersecurity@ch.abb.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-669
cybersecurity@ch.abb.com: CWE-305

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_historian:3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DAAEE275-0C2C-4D15-B0CB-B51706015769"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_historian:3.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8A89B5F4-5BE7-4B0E-9ADF-46630017221C"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "21FB4D84-598C-486D-9A16-F24AEAA8B2A5"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "96371CD8-6C8A-459E-9A7E-34694B9F648E"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:2.1:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5D3E3D88-6544-459D-A5F3-AFB682FF8462"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:2.1:sp2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED64EBDB-B30B-49ED-88C9-7FC2B092FEA3"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A6281EC9-5771-4B95-B18C-C11A0EABDA25"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3B553708-205B-4B87-BFE9-1570C1AAE06F"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C8D38257-9207-4AED-818F-EA6E09393491"
          },
          {
            "criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EBFA7A6-0EF8-46FC-B92F-AF448531B997"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References