Sign-up

ID

VAR-202006-1883


CVE

CVE-2020-14478


TITLE

FactoryTalk Services Platform  In  XML  External entity vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2022-006077

DESCRIPTION

A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-level services. FactoryTalk Services Platform for, XML There is a vulnerability in an external entity.Information is obtained and service operation is interrupted (DoS) It may be in a state. Rockwell Automation FactoryTalk Services Platform is a service platform composed of multiple products by Rockwell Automation in the United States. It provides routine services for applications, such as diagnostic information, health monitoring, and real-time data access

Trust: 2.25

sources: NVD: CVE-2020-14478 // JVNDB: JVNDB-2022-006077 // CNVD: CNVD-2020-38418 // VULHUB: VHN-167360

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-38418

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:factorytalk services platformscope:lteversion:6.11.00

Trust: 1.0

vendor:rockwell automationmodel:factorytalk services platformscope:eqversion: -

Trust: 0.8

vendor:rockwell automationmodel:factorytalk services platformscope: - version: -

Trust: 0.8

vendor:rockwellmodel:automation factorytalk services platformscope:lteversion:<=6.11.00

Trust: 0.6

sources: CNVD: CNVD-2020-38418 // JVNDB: JVNDB-2022-006077 // NVD: CVE-2020-14478

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-14478
value: HIGH

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2020-14478
value: HIGH

Trust: 1.0

NVD: CVE-2020-14478
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-38418
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202006-1746
value: HIGH

Trust: 0.6

VULHUB: VHN-167360
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-14478
severity: MEDIUM
baseScore: 5.6
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2020-38418
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-167360
severity: MEDIUM
baseScore: 5.6
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-14478
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.2
version: 3.1

Trust: 2.0

NVD: CVE-2020-14478
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-38418 // VULHUB: VHN-167360 // JVNDB: JVNDB-2022-006077 // CNNVD: CNNVD-202006-1746 // NVD: CVE-2020-14478 // NVD: CVE-2020-14478

PROBLEMTYPE DATA

problemtype:CWE-611

Trust: 1.1

problemtype:XML Improper restriction of external entity references (CWE-611) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-167360 // JVNDB: JVNDB-2022-006077 // NVD: CVE-2020-14478

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202006-1746

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202006-1746

PATCH

title:Top Pageurl:https://www.rockwellautomation.com/en-us.html

Trust: 0.8

title:Patch for Rockwell Automation FactoryTalk Services Platform XML external entity injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/225337

Trust: 0.6

title:Rockwell Automation FactoryTalk Services Platform Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122389

Trust: 0.6

sources: CNVD: CNVD-2020-38418 // JVNDB: JVNDB-2022-006077 // CNNVD: CNNVD-202006-1746

EXTERNAL IDS

db:NVDid:CVE-2020-14478

Trust: 3.9

db:ICS CERTid:ICSA-20-177-02

Trust: 3.1

db:JVNDBid:JVNDB-2022-006077

Trust: 0.8

db:CNVDid:CNVD-2020-38418

Trust: 0.7

db:CNNVDid:CNNVD-202006-1746

Trust: 0.7

db:VULHUBid:VHN-167360

Trust: 0.1

sources: CNVD: CNVD-2020-38418 // VULHUB: VHN-167360 // JVNDB: JVNDB-2022-006077 // CNNVD: CNNVD-202006-1746 // NVD: CVE-2020-14478

REFERENCES

url:https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-02

Trust: 2.5

url:https://www.us-cert.gov/ics/advisories/icsa-20-177-02

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14478

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2020-14478/

Trust: 0.6

sources: CNVD: CNVD-2020-38418 // VULHUB: VHN-167360 // JVNDB: JVNDB-2022-006077 // CNNVD: CNNVD-202006-1746 // NVD: CVE-2020-14478

SOURCES

db:CNVDid:CNVD-2020-38418
db:VULHUBid:VHN-167360
db:JVNDBid:JVNDB-2022-006077
db:CNNVDid:CNNVD-202006-1746
db:NVDid:CVE-2020-14478

LAST UPDATE DATE

2025-04-18T23:43:40.224000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-38418date:2020-07-13T00:00:00
db:VULHUBid:VHN-167360date:2022-03-04T00:00:00
db:JVNDBid:JVNDB-2022-006077date:2023-06-28T09:18:00
db:CNNVDid:CNNVD-202006-1746date:2022-03-10T00:00:00
db:NVDid:CVE-2020-14478date:2025-04-17T19:15:49.883

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-38418date:2020-07-13T00:00:00
db:VULHUBid:VHN-167360date:2022-02-24T00:00:00
db:JVNDBid:JVNDB-2022-006077date:2023-06-28T00:00:00
db:CNNVDid:CNNVD-202006-1746date:2020-06-25T00:00:00
db:NVDid:CVE-2020-14478date:2022-02-24T19:15:08.760