CVE-2020-24683

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch	Mitigation Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:abb:symphony_\+_historian:3.0:::::::*
	cpe:2.3:a:abb:symphony_\+_historian:3.1:::::::*
	cpe:2.3:a:abb:symphony_\+_operations:1.1:::::::*
	cpe:2.3:a:abb:symphony_\+_operations:2.0:::::::*
	cpe:2.3:a:abb:symphony_\+_operations:2.1:sp1::::::
	cpe:2.3:a:abb:symphony_\+_operations:2.1:sp2::::::
	cpe:2.3:a:abb:symphony_\+_operations:3.0:::::::*
	cpe:2.3:a:abb:symphony_\+_operations:3.1:::::::*
	cpe:2.3:a:abb:symphony_\+_operations:3.2:::::::*
	cpe:2.3:a:abb:symphony_\+_operations:3.3:::::::*

History

21 Nov 2024, 05:15

Type	Values Removed	Values Added
References	~~() https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - Mitigation, Vendor Advisory~~	() https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - Mitigation, Vendor Advisory

07 Oct 2021, 19:05

Type	Values Removed	Values Added
CPE	cpe:2.3:a:abb:symphony_plus_operations:3.2:::::::* cpe:2.3:a:abb:symphony_plus_operations:3.0:::::::* cpe:2.3:a:abb:symphony_plus_operations:2.1:sp1:::::: cpe:2.3:a:abb:symphony_plus_historian:3.1:::::::* cpe:2.3:a:abb:symphony_plus_operations:2.1:sp2:::::: cpe:2.3:a:abb:symphony_plus_operations:3.3:::::::* cpe:2.3:a:abb:symphony_plus_operations:1.1:::::::* cpe:2.3:a:abb:symphony_plus_operations:3.1:::::::* cpe:2.3:a:abb:symphony_plus_historian:3.0:::::::* cpe:2.3:a:abb:symphony_plus_operations:2.0:::::::*	cpe:2.3:a:abb:symphony_\+_operations:3.1:::::::* cpe:2.3:a:abb:symphony_\+_operations:1.1:::::::* cpe:2.3:a:abb:symphony_\+_operations:2.1:sp2:::::: cpe:2.3:a:abb:symphony_\+_operations:2.0:::::::* cpe:2.3:a:abb:symphony_\+_historian:3.0:::::::* cpe:2.3:a:abb:symphony_\+_operations:2.1:sp1:::::: cpe:2.3:a:abb:symphony_\+_historian:3.1:::::::* cpe:2.3:a:abb:symphony_\+_operations:3.3:::::::* cpe:2.3:a:abb:symphony_\+_operations:3.0:::::::* cpe:2.3:a:abb:symphony_\+_operations:3.2:::::::*

Information

Published : 2020-12-22 22:15

Updated : 2024-11-21 05:15

NVD link : CVE-2020-24683

Mitre link : CVE-2020-24683

CVE.ORG link : CVE-2020-24683

JSON object : View

Products Affected

abb

symphony_\+_operations
symphony_\+_historian

CWE

CWE-305

Authentication Bypass by Primary Weakness

CWE-602

Client-Side Enforcement of Server-Side Security

CWE-669

Incorrect Resource Transfer Between Spheres

{"id": "CVE-2020-24683", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cybersecurity@ch.abb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-12-22T22:15:13.757", "references": [{"url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch", "tags": ["Mitigation", "Vendor Advisory"], "source": "cybersecurity@ch.abb.com"}, {"url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@ch.abb.com", "description": [{"lang": "en", "value": "CWE-305"}, {"lang": "en", "value": "CWE-602"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-669"}]}], "descriptions": [{"lang": "en", "value": "The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application."}, {"lang": "es", "value": "Las versiones afectadas de S+ Operations (versi\u00f3n 2.1 SP1 y anteriores) utilizaron un enfoque para la autenticaci\u00f3n de usuarios que se basa en la comprobaci\u00f3n en el nodo del cliente (autenticaci\u00f3n del lado del cliente). Esto no es tan seguro como hacer que el servidor valide una aplicaci\u00f3n cliente antes de permitir una conexi\u00f3n. Por lo tanto, si la comunicaci\u00f3n de red o los endpoints para estas aplicaciones no est\u00e1n protegidas, los actores no autorizados pueden omitir la autenticaci\u00f3n y llevar a cabo conexiones no autorizadas hacia la aplicaci\u00f3n del servidor"}], "lastModified": "2024-11-21T05:15:46.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:abb:symphony_\\+_historian:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAAEE275-0C2C-4D15-B0CB-B51706015769"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_historian:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A89B5F4-5BE7-4B0E-9ADF-46630017221C"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21FB4D84-598C-486D-9A16-F24AEAA8B2A5"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96371CD8-6C8A-459E-9A7E-34694B9F648E"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:2.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D3E3D88-6544-459D-A5F3-AFB682FF8462"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:2.1:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED64EBDB-B30B-49ED-88C9-7FC2B092FEA3"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6281EC9-5771-4B95-B18C-C11A0EABDA25"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B553708-205B-4B87-BFE9-1570C1AAE06F"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8D38257-9207-4AED-818F-EA6E09393491"}, {"criteria": "cpe:2.3:a:abb:symphony_\\+_operations:3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EBFA7A6-0EF8-46FC-B92F-AF448531B997"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@ch.abb.com"}

9.8 /10