Details of VAR-202005-0969

ID

VAR-202005-0969

CVE

CVE-2020-9045

TITLE

plural Johnson Controls Vulnerability in plaintext storage of important product information

Trust: 0.8

sources: JVNDB: JVNDB-2020-004666

DESCRIPTION

During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation. Johnson Controls Several products provided by the company contain vulnerabilities in the plaintext storage of important information. The product is vulnerable to plaintext storage of important information (CWE-312) Exists.The credentials of the user who installed or upgraded the product are stored in clear text in a log file and are not deleted after installation, which could lead to the theft of credentials by a remote third party. The Software House C?CURE 9000 is a scalable multi-site access control and alarm monitoring system. An attacker could exploit this vulnerability to gain access to the application's credentials

Trust: 1.71

sources: NVD: CVE-2020-9045 // JVNDB: JVNDB-2020-004666 // VULHUB: VHN-187170

AFFECTED PRODUCTS

vendor:	tyco	model:	victor video management system	scope:	eq	version:	5.2	Trust: 1.0
vendor:	johnsoncontrols	model:	c-cure 9000	scope:	eq	version:	2.70	Trust: 1.0
vendor:	johnson controls	model:	american dynamics victor video management system	scope:	eq	version:	version 5.2	Trust: 0.8
vendor:	johnson controls	model:	software house c cure	scope:	eq	version:	version 2.70	Trust: 0.8

sources: JVNDB: JVNDB-2020-004666 // NVD: CVE-2020-9045

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-9045
value:	MEDIUM
Trust: 1.0
productsecurity@jci.com:	CVE-2020-9045
value:	CRITICAL
Trust: 1.0
IPA:	JVNDB-2020-004666
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-202005-1114
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-187170
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-9045
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-187170
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-9045
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
productsecurity@jci.com:	CVE-2020-9045
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	6.0
version:	3.1
Trust: 1.0
IPA score:	JVNDB-2020-004666
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-187170 // JVNDB: JVNDB-2020-004666 // CNNVD: CNNVD-202005-1114 // NVD: CVE-2020-9045 // NVD: CVE-2020-9045

PROBLEMTYPE DATA

problemtype:

CWE-312

Trust: 1.9

sources: VULHUB: VHN-187170 // JVNDB: JVNDB-2020-004666 // NVD: CVE-2020-9045

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202005-1114

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202005-1114

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-004666

PATCH

title:	JCI-PSA-2020-4	url:	https://www.johnsoncontrols.com/cyber-solutions/security-advisories	Trust: 0.8
title:	Johnson Controls Software House C•CURE 9000 and American Dynamics victor Video Management System Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=119651	Trust: 0.6

sources: JVNDB: JVNDB-2020-004666 // CNNVD: CNNVD-202005-1114

EXTERNAL IDS

db:	NVD	id:	CVE-2020-9045	Trust: 2.5
db:	ICS CERT	id:	ICSA-20-142-01	Trust: 2.5
db:	JVN	id:	JVNVU91294008	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-004666	Trust: 0.8
db:	CNNVD	id:	CNNVD-202005-1114	Trust: 0.7
db:	NSFOCUS	id:	47707	Trust: 0.6
db:	VULHUB	id:	VHN-187170	Trust: 0.1

sources: VULHUB: VHN-187170 // JVNDB: JVNDB-2020-004666 // CNNVD: CNNVD-202005-1114 // NVD: CVE-2020-9045

REFERENCES

url:	https://www.us-cert.gov/ics/advisories/icsa-20-142-01	Trust: 3.1
url:	https://www.johnsoncontrols.com/cyber-solutions/security-advisories	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-9045	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu91294008/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-9045	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/47707	Trust: 0.6

sources: VULHUB: VHN-187170 // JVNDB: JVNDB-2020-004666 // CNNVD: CNNVD-202005-1114 // NVD: CVE-2020-9045

SOURCES

db:	VULHUB	id:	VHN-187170
db:	JVNDB	id:	JVNDB-2020-004666
db:	CNNVD	id:	CNNVD-202005-1114
db:	NVD	id:	CVE-2020-9045

LAST UPDATE DATE

2024-11-23T22:05:37.935000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-187170	date:	2022-10-13T00:00:00
db:	JVNDB	id:	JVNDB-2020-004666	date:	2020-05-25T00:00:00
db:	CNNVD	id:	CNNVD-202005-1114	date:	2020-08-12T00:00:00
db:	NVD	id:	CVE-2020-9045	date:	2024-11-21T05:39:53.510

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-187170	date:	2020-05-21T00:00:00
db:	JVNDB	id:	JVNDB-2020-004666	date:	2020-05-25T00:00:00
db:	CNNVD	id:	CNNVD-202005-1114	date:	2020-05-21T00:00:00
db:	NVD	id:	CVE-2020-9045	date:	2020-05-21T15:15:10.013