Sign-up

ID

VAR-202009-0599


CVE

CVE-2020-16242


TITLE

GE Made Reason S20 Multiple cross-site scripting vulnerabilities in the series

Trust: 0.8

sources: JVNDB: JVNDB-2020-008763

DESCRIPTION

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts. Reason S20 The series is General Electric An industrial managed Ethernet switch provided by the company. Reason S20 There are several vulnerabilities in the series: * Cross-site scripting (CWE-79) - CVE-2020-16242 * Cross-site scripting (CWE-79) - CVE-2020-16246The expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2020-16242 * A remote third party can use cross-site scripting to execute arbitrary scripts on the user's web browser. - CVE-2020-16246

Trust: 2.25

sources: NVD: CVE-2020-16242 // JVNDB: JVNDB-2020-008763 // CNVD: CNVD-2020-53778 // VULMON: CVE-2020-16242

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-53778

AFFECTED PRODUCTS

vendor:gemodel:s2020scope:ltversion:07a06

Trust: 1.0

vendor:gemodel:s2024scope:ltversion:07a06

Trust: 1.0

vendor:general electricmodel:s2020scope:eqversion:07a06

Trust: 0.8

vendor:general electricmodel:s2024scope:eqversion:07a06

Trust: 0.8

vendor:generalmodel:electric reason s20 ethernet switch <s2020 07a06scope: - version: -

Trust: 0.6

vendor:generalmodel:electric reason s20 ethernet switch <s2024 07a06scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2020-53778 // JVNDB: JVNDB-2020-008763 // NVD: CVE-2020-16242

CVSS

SEVERITY

CVSSV2

CVSSV3

IPA: JVNDB-2020-008763
value: MEDIUM

Trust: 1.6

nvd@nist.gov: CVE-2020-16242
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2020-53778
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202009-1316
value: MEDIUM

Trust: 0.6

VULMON: CVE-2020-16242
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-16242
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2020-53778
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-16242
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

IPA score: JVNDB-2020-008763
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

IPA score: JVNDB-2020-008763
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-53778 // VULMON: CVE-2020-16242 // JVNDB: JVNDB-2020-008763 // JVNDB: JVNDB-2020-008763 // CNNVD: CNNVD-202009-1316 // NVD: CVE-2020-16242

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

sources: NVD: CVE-2020-16242

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202009-1316

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202009-1316

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-008763

PATCH
title:Reason S20url:https://www.gegridsolutions.com/app/viewfiles.aspx?prod=S20&type=7
Trust: 0.8
title:Reason S20 Industrial Managed Ethernet Switch Firmware version 07A06 Release Notesurl:https://www.gegridsolutions.com/products/software/reason-s20-fw-07a06-release-notes.pdf
Trust: 0.8
title:Patch for GE Reason S20 Ethernet Switch cross-site scripting vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/235468
Trust: 0.6
title:GE Reason S20 managed Ethernet switches Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131081
Trust: 0.6
title: - url:https://github.com/Live-Hack-CVE/CVE-2020-16242 
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-53778 // 
            
            
            
            VULMON: CVE-2020-16242 // 
            
            
            
            JVNDB: JVNDB-2020-008763 // 
            
            
            
            CNNVD: CNNVD-202009-1316

EXTERNAL IDS
db:NVDid:CVE-2020-16242
Trust: 3.1
db:ICS CERTid:ICSA-20-266-02
Trust: 3.1
db:JVNid:JVNVU94954118
Trust: 0.8
db:JVNDBid:JVNDB-2020-008763
Trust: 0.8
db:CNVDid:CNVD-2020-53778
Trust: 0.6
db:AUSCERTid:ESB-2020.3265
Trust: 0.6
db:CNNVDid:CNNVD-202009-1316
Trust: 0.6
db:VULMONid:CVE-2020-16242
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-53778 // 
            
            
            
            VULMON: CVE-2020-16242 // 
            
            
            
            JVNDB: JVNDB-2020-008763 // 
            
            
            
            CNNVD: CNNVD-202009-1316 // 
            
            
            
            NVD: CVE-2020-16242

REFERENCES
url:https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02
Trust: 3.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-16242
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-16246
Trust: 0.8
url:https://jvn.jp/vu/jvnvu94954118/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2020-16242
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.3265/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/79.html
Trust: 0.1
url:https://github.com/live-hack-cve/cve-2020-16242
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-53778 // 
            
            
            
            VULMON: CVE-2020-16242 // 
            
            
            
            JVNDB: JVNDB-2020-008763 // 
            
            
            
            CNNVD: CNNVD-202009-1316 // 
            
            
            
            NVD: CVE-2020-16242

SOURCES
db:CNVDid:CNVD-2020-53778
db:VULMONid:CVE-2020-16242
db:JVNDBid:JVNDB-2020-008763
db:CNNVDid:CNNVD-202009-1316
db:NVDid:CVE-2020-16242

LAST UPDATE DATE
2024-11-23T22:55:04.669000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-53778date:2020-09-24T00:00:00
db:VULMONid:CVE-2020-16242date:2023-01-31T00:00:00
db:JVNDBid:JVNDB-2020-008763date:2020-09-24T00:00:00
db:CNNVDid:CNNVD-202009-1316date:2020-10-21T00:00:00
db:NVDid:CVE-2020-16242date:2024-11-21T05:07:00.613

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-53778date:2020-09-24T00:00:00
db:VULMONid:CVE-2020-16242date:2020-09-25T00:00:00
db:JVNDBid:JVNDB-2020-008763date:2020-09-24T00:00:00
db:CNNVDid:CNNVD-202009-1316date:2020-09-22T00:00:00
db:NVDid:CVE-2020-16242date:2020-09-25T18:15:15.113