ID
VAR-202012-0319
CVE
CVE-2020-24674
TITLE
S+ Operations and S+ Historian Authentication Vulnerability in Microsoft
Trust: 0.8
DESCRIPTION
In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines. S+ Operations and S+ Historian Contains an improper authentication vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Both ABB Symphony Plus Operations and ABB Symphony Plus Historian are products of ABB, Switzerland. ABB Symphony Plus Operations is a management device used in industrial environments to improve operational efficiency. The device provides an easy-to-use human-machine interface, seamlessly integrates all plant equipment and subsystems using industry-standard protocols and technologies, and provides functions such as alarm management, process optimization, and more. ABB Symphony Plus Historian is a device for visually viewing and managing historical information of industrial equipment
Trust: 1.71
AFFECTED PRODUCTS
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 2.0 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 3.0 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ historian | scope: | eq | version: | 3.1 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 2.1 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 3.3 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 1.1 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 3.2 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ historian | scope: | eq | version: | 3.0 | Trust: 1.0 |
| vendor: | abb | model: | symphony \+ operations | scope: | eq | version: | 3.1 | Trust: 1.0 |
| vendor: | abb | model: | symphony plus historian | scope: | - | version: | - | Trust: 0.8 |
| vendor: | abb | model: | symphony plus operations | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-863 | Trust: 1.1 |
| problemtype: | CWE-285 | Trust: 1.0 |
| problemtype: | Bad authentication (CWE-863) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
authorization issue
Trust: 0.6
PATCH
| title: | Vulnerability ID | url: | https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch | Trust: 0.8 |
| title: | ABB Symphony Plus Operations and ABB Symphony Plus Historian Remediation measures for authorization problem vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=137818 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-24674 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2020-014749 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202012-1473 | Trust: 0.7 |
| db: | VULHUB | id: | VHN-178576 | Trust: 0.1 |
REFERENCES
| url: | https://search.abb.com/library/download.aspx?documentid=2paa123980&languagecode=en&documentpartid=&action=launch | Trust: 1.6 |
| url: | https://search.abb.com/library/download.aspx?documentid=2paa123982&languagecode=en&documentpartid=&action=launch | Trust: 1.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-24674 | Trust: 1.4 |
| url: | https://search.abb.com/library/download.aspx?documentid=2paa123980&languagecode=en&documentpartid=&action=launch | Trust: 0.1 |
| url: | https://search.abb.com/library/download.aspx?documentid=2paa123982&languagecode=en&documentpartid=&action=launch | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-178576 |
| db: | JVNDB | id: | JVNDB-2020-014749 |
| db: | CNNVD | id: | CNNVD-202012-1473 |
| db: | NVD | id: | CVE-2020-24674 |
LAST UPDATE DATE
2024-11-23T22:37:11.598000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-178576 | date: | 2021-10-07T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-014749 | date: | 2021-08-30T08:30:00 |
| db: | CNNVD | id: | CNNVD-202012-1473 | date: | 2020-12-24T00:00:00 |
| db: | NVD | id: | CVE-2020-24674 | date: | 2024-11-21T05:15:41.573 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-178576 | date: | 2020-12-22T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-014749 | date: | 2021-08-30T00:00:00 |
| db: | CNNVD | id: | CNNVD-202012-1473 | date: | 2020-12-22T00:00:00 |
| db: | NVD | id: | CVE-2020-24674 | date: | 2020-12-22T22:15:13.147 |