CVE-2020-24683

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Authentication Bypass by Primary Weakness pada abb symphony + historian, abb symphony + operations. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.

Rincian

Terbit di NVD

22 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-305: Authentication Bypass by Primary Weakness
CWE-602: Client-Side Enforcement of Server-Side Security
CWE-669: Incorrect Resource Transfer Between Spheres

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Laun... mitigasi · advisory vendor