Details of VAR-202004-2168

ID

VAR-202004-2168

CVE

CVE-2020-8489

TITLE

ABB System 800xA Information Management Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-005104

DESCRIPTION

Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management history services unavailable. ABB System 800xA Information Management There is an unspecified vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. The system provides intelligent data access functions that can access real-time and historical information of all applications in the extended automation system

Trust: 2.7

sources: NVD: CVE-2020-8489 // JVNDB: JVNDB-2020-005104 // CNVD: CNVD-2020-27098 // IVD: 24d10332-4a66-4acb-bd79-583f12d2ddf0 // IVD: 9a6d8fcb-222a-4a01-a1e3-067966e75bf5 // VULHUB: VHN-186614 // VULMON: CVE-2020-8489

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.0

sources: IVD: 24d10332-4a66-4acb-bd79-583f12d2ddf0 // IVD: 9a6d8fcb-222a-4a01-a1e3-067966e75bf5 // CNVD: CNVD-2020-27098

AFFECTED PRODUCTS

vendor:	abb	model:	800xa information management	scope:	eq	version:	*	Trust: 1.1
vendor:	abb	model:	system 800xa information manager	scope:	-	version:	-	Trust: 0.8
vendor:	abb	model:	system 800xa information management	scope:	-	version:	-	Trust: 0.6
vendor:	800xa information management	model:	-	scope:	eq	version:	*	Trust: 0.4

sources: IVD: 24d10332-4a66-4acb-bd79-583f12d2ddf0 // IVD: 9a6d8fcb-222a-4a01-a1e3-067966e75bf5 // CNVD: CNVD-2020-27098 // VULMON: CVE-2020-8489 // JVNDB: JVNDB-2020-005104 // NVD: CVE-2020-8489

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-8489
value:	HIGH
Trust: 1.0
cybersecurity@ch.abb.com:	CVE-2020-8489
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-005104
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-27098
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202004-2376
value:	HIGH
Trust: 0.6
IVD:	24d10332-4a66-4acb-bd79-583f12d2ddf0
value:	HIGH
Trust: 0.2
IVD:	9a6d8fcb-222a-4a01-a1e3-067966e75bf5
value:	HIGH
Trust: 0.2
VULHUB:	VHN-186614
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2020-8489
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-8489
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2020-005104
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-27098
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	24d10332-4a66-4acb-bd79-583f12d2ddf0
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	9a6d8fcb-222a-4a01-a1e3-067966e75bf5
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-186614
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-8489
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	JVNDB-2020-005104
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: 24d10332-4a66-4acb-bd79-583f12d2ddf0 // IVD: 9a6d8fcb-222a-4a01-a1e3-067966e75bf5 // CNVD: CNVD-2020-27098 // VULHUB: VHN-186614 // VULMON: CVE-2020-8489 // JVNDB: JVNDB-2020-005104 // CNNVD: CNNVD-202004-2376 // NVD: CVE-2020-8489 // NVD: CVE-2020-8489

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.0
problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2020-005104 // NVD: CVE-2020-8489

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202004-2376

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-202004-2376

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-005104

PATCH

title:

SECURITY Interprocess communication vulnerability in System 800xA

url:

https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch

Trust: 0.8

sources: JVNDB: JVNDB-2020-005104

EXTERNAL IDS

db:	NVD	id:	CVE-2020-8489	Trust: 3.6
db:	ICS CERT	id:	ICSA-20-154-03	Trust: 1.4
db:	CNVD	id:	CNVD-2020-27098	Trust: 1.1
db:	CNNVD	id:	CNNVD-202004-2376	Trust: 1.1
db:	JVN	id:	JVNVU94921886	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-005104	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.1923	Trust: 0.6
db:	IVD	id:	24D10332-4A66-4ACB-BD79-583F12D2DDF0	Trust: 0.2
db:	IVD	id:	9A6D8FCB-222A-4A01-A1E3-067966E75BF5	Trust: 0.2
db:	VULHUB	id:	VHN-186614	Trust: 0.1
db:	VULMON	id:	CVE-2020-8489	Trust: 0.1

REFERENCES

url:	https://search.abb.com/library/download.aspx?documentid=2paa121236&languagecode=en&documentpartid=&action=launch	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2020-8489	Trust: 2.0
url:	https://www.us-cert.gov/ics/advisories/icsa-20-154-03	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-8489	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu94921886/index.html	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.1923/	Trust: 0.6
url:	https://search.abb.com/library/download.aspx?documentid=2paa121236&languagecode=en&documentpartid=&action=launch	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-27098 // VULHUB: VHN-186614 // VULMON: CVE-2020-8489 // JVNDB: JVNDB-2020-005104 // CNNVD: CNNVD-202004-2376 // NVD: CVE-2020-8489

SOURCES

db:	IVD	id:	24d10332-4a66-4acb-bd79-583f12d2ddf0
db:	IVD	id:	9a6d8fcb-222a-4a01-a1e3-067966e75bf5
db:	CNVD	id:	CNVD-2020-27098
db:	VULHUB	id:	VHN-186614
db:	VULMON	id:	CVE-2020-8489
db:	JVNDB	id:	JVNDB-2020-005104
db:	CNNVD	id:	CNNVD-202004-2376
db:	NVD	id:	CVE-2020-8489

LAST UPDATE DATE

2024-11-23T21:35:51.671000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-27098	date:	2020-05-08T00:00:00
db:	VULHUB	id:	VHN-186614	date:	2020-05-08T00:00:00
db:	VULMON	id:	CVE-2020-8489	date:	2020-05-08T00:00:00
db:	JVNDB	id:	JVNDB-2020-005104	date:	2020-06-05T00:00:00
db:	CNNVD	id:	CNNVD-202004-2376	date:	2020-06-08T00:00:00
db:	NVD	id:	CVE-2020-8489	date:	2024-11-21T05:38:56.057

SOURCES RELEASE DATE

db:	IVD	id:	24d10332-4a66-4acb-bd79-583f12d2ddf0	date:	2020-04-28T00:00:00
db:	IVD	id:	9a6d8fcb-222a-4a01-a1e3-067966e75bf5	date:	2020-04-28T00:00:00
db:	CNVD	id:	CNVD-2020-27098	date:	2020-05-08T00:00:00
db:	VULHUB	id:	VHN-186614	date:	2020-04-29T00:00:00
db:	VULMON	id:	CVE-2020-8489	date:	2020-04-29T00:00:00
db:	JVNDB	id:	JVNDB-2020-005104	date:	2020-06-05T00:00:00
db:	CNNVD	id:	CNNVD-202004-2376	date:	2020-04-28T00:00:00
db:	NVD	id:	CVE-2020-8489	date:	2020-04-29T02:15:12.513