cnvd - cnvd-2020-32228

CNVD-2020-32228

Vulnerability from cnvd - Published: 2020-06-10

Title

多款ABB产品信息泄露漏洞

Description

ABB Ability System 800xA等都是瑞士ABB公司的产品。ABB Ability System 800xA是一套用于工控行业的分布式控制系统。ABB Compact HMI是一套监控和数据采集系统。ABB Control Builder Safe是一款用于配置和下载AC 800M High Integrity安全应用程序的工程工具。多款ABB产品中存在信息泄露漏洞，该漏洞源于程序将敏感信息写入到未被保护的文件，攻击者可利用该漏洞完全控制设备。

Severity

高

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://new.abb.com/

Reference

https://www.us-cert.gov/ics/advisories/icsa-20-154-04

Impacted products

Name
['ABB OPCServer for AC800M <=6.0', 'ABB Control Builder Mprofessional <=6.0', 'ABB MMSServer for AC800M <=6.0', 'ABB Base Software for SoftControl <=6.0', 'ABB Ability System 800xA and related system extensions 5.1', 'ABB Ability System 800xA and related system extensions 6.0', 'ABB Ability System 800xA and related system extensions 6.1', 'ABB Compact HMI 5.1', 'ABB Compact HMI 6.0', 'ABB Control Builder Safe 1.0', 'ABB Control Builder Safe 1.1', 'ABB Control Builder Safe 2.0', 'ABB Ability Symphony Plus – S+ Operations >=3.0，<=3.2', 'ABB Ability Symphony Plus – S+ Engineering >=1.1，<=2.2', 'ABB Composer Harmony 5.1', 'ABB Composer Harmony 6.0', 'ABB Composer Harmony 6.1', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 5.3', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 6.1', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 6.2', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 6.3', 'ABB Harmony OPC Server (HAOPC) 6.0', 'ABB Harmony OPC Server (HAOPC) 6.1', 'ABB Harmony OPC Server (HAOPC) 7.0', 'ABB Ability System 800xA / Advant OCS Control Builder A 1.3', 'ABB Ability System 800xA / Advant OCS Control Builder A 1.4', 'ABB Advant OCS AC 100 OPC Server 5.1', 'ABB Advant OCS AC 100 OPC Server 6.0', 'ABB Advant OCS AC 100 OPC Server 6.1', 'ABB Composer CTK 6.1', 'ABB Composer CTK 6.2', 'ABB AdvaBuild 3.7 SP1', 'ABB AdvaBuild 3.7 SP2', 'ABB OPC Server MOD 300 (non-800xA) 1.4', 'ABB OPC Data Link 2.1', 'ABB OPC Data Link 2.2', 'ABB Ability Knowledge Manager 8.0', 'ABB Ability Knowledge Manager 9.0', 'ABB Ability Knowledge Manager 9.1', 'ABB Ability Manufacturing Operations Management 1812', 'ABB Ability Manufacturing Operations Management 1909']

Name

['ABB OPCServer for AC800M <=6.0', 'ABB Control Builder Mprofessional <=6.0', 'ABB MMSServer for AC800M <=6.0', 'ABB Base Software for SoftControl <=6.0', 'ABB Ability System 800xA and related system extensions 5.1', 'ABB Ability System 800xA and related system extensions 6.0', 'ABB Ability System 800xA and related system extensions 6.1', 'ABB Compact HMI 5.1', 'ABB Compact HMI 6.0', 'ABB Control Builder Safe 1.0', 'ABB Control Builder Safe 1.1', 'ABB Control Builder Safe 2.0', 'ABB Ability Symphony Plus – S+ Operations >=3.0，<=3.2', 'ABB Ability Symphony Plus – S+ Engineering >=1.1，<=2.2', 'ABB Composer Harmony 5.1', 'ABB Composer Harmony 6.0', 'ABB Composer Harmony 6.1', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 5.3', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 6.1', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 6.2', 'ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 6.3', 'ABB Harmony OPC Server (HAOPC) 6.0', 'ABB Harmony OPC Server (HAOPC) 6.1', 'ABB Harmony OPC Server (HAOPC) 7.0', 'ABB Ability System 800xA / Advant OCS Control Builder A 1.3', 'ABB Ability System 800xA / Advant OCS Control Builder A 1.4', 'ABB Advant OCS AC 100 OPC Server 5.1', 'ABB Advant OCS AC 100 OPC Server 6.0', 'ABB Advant OCS AC 100 OPC Server 6.1', 'ABB Composer CTK 6.1', 'ABB Composer CTK 6.2', 'ABB AdvaBuild 3.7 SP1', 'ABB AdvaBuild 3.7 SP2', 'ABB OPC Server MOD 300 (non-800xA) 1.4', 'ABB OPC Data Link 2.1', 'ABB OPC Data Link 2.2', 'ABB Ability Knowledge Manager 8.0', 'ABB Ability Knowledge Manager 9.0', 'ABB Ability Knowledge Manager 9.1', 'ABB Ability Manufacturing Operations Management 1812', 'ABB Ability Manufacturing Operations Management 1909']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-8481"
    }
  },
  "description": "ABB Ability System 800xA\u7b49\u90fd\u662f\u745e\u58ebABB\u516c\u53f8\u7684\u4ea7\u54c1\u3002ABB Ability System 800xA\u662f\u4e00\u5957\u7528\u4e8e\u5de5\u63a7\u884c\u4e1a\u7684\u5206\u5e03\u5f0f\u63a7\u5236\u7cfb\u7edf\u3002ABB Compact HMI\u662f\u4e00\u5957\u76d1\u63a7\u548c\u6570\u636e\u91c7\u96c6\u7cfb\u7edf\u3002ABB Control Builder Safe\u662f\u4e00\u6b3e\u7528\u4e8e\u914d\u7f6e\u548c\u4e0b\u8f7dAC 800M High Integrity\u5b89\u5168\u5e94\u7528\u7a0b\u5e8f\u7684\u5de5\u7a0b\u5de5\u5177\u3002\n\n\u591a\u6b3eABB\u4ea7\u54c1\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5c06\u654f\u611f\u4fe1\u606f\u5199\u5165\u5230\u672a\u88ab\u4fdd\u62a4\u7684\u6587\u4ef6\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5b8c\u5168\u63a7\u5236\u8bbe\u5907\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://new.abb.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-32228",
  "openTime": "2020-06-10",
  "products": {
    "product": [
      "ABB OPCServer for AC800M \u003c=6.0",
      "ABB Control Builder Mprofessional \u003c=6.0",
      "ABB MMSServer for AC800M \u003c=6.0",
      "ABB Base Software for SoftControl \u003c=6.0",
      "ABB Ability System 800xA and related system extensions 5.1",
      "ABB Ability System 800xA and related system extensions  6.0",
      "ABB Ability System 800xA and related system extensions  6.1",
      "ABB Compact HMI 5.1",
      "ABB Compact HMI  6.0",
      "ABB Control Builder Safe 1.0",
      "ABB Control Builder Safe  1.1",
      "ABB Control Builder Safe  2.0",
      "ABB Ability Symphony Plus \u2013 S+ Operations \u003e=3.0\uff0c\u003c=3.2",
      "ABB Ability Symphony Plus \u2013 S+ Engineering \u003e=1.1\uff0c\u003c=2.2",
      "ABB Composer Harmony 5.1",
      "ABB Composer Harmony  6.0",
      "ABB Composer Harmony  6.1",
      "ABB Composer Melody (incl. SPE for Melody 1.0 SPx) 5.3",
      "ABB Composer Melody (incl. SPE for Melody 1.0 SPx)  6.1",
      "ABB Composer Melody (incl. SPE for Melody 1.0 SPx)  6.2",
      "ABB Composer Melody (incl. SPE for Melody 1.0 SPx)  6.3",
      "ABB Harmony OPC Server (HAOPC) 6.0",
      "ABB Harmony OPC Server (HAOPC)  6.1",
      "ABB Harmony OPC Server (HAOPC)  7.0",
      "ABB Ability System 800xA / Advant OCS Control Builder A 1.3",
      "ABB Ability System 800xA / Advant OCS Control Builder A  1.4",
      "ABB Advant OCS AC 100 OPC Server 5.1",
      "ABB Advant OCS AC 100 OPC Server  6.0",
      "ABB Advant OCS AC 100 OPC Server  6.1",
      "ABB Composer CTK 6.1",
      "ABB Composer CTK  6.2",
      "ABB AdvaBuild 3.7 SP1",
      "ABB AdvaBuild  3.7 SP2",
      "ABB OPC Server MOD 300 (non-800xA) 1.4",
      "ABB OPC Data Link 2.1",
      "ABB OPC Data Link  2.2",
      "ABB Ability Knowledge Manager 8.0",
      "ABB Ability Knowledge Manager  9.0",
      "ABB Ability Knowledge Manager  9.1",
      "ABB Ability Manufacturing Operations Management 1812",
      "ABB Ability Manufacturing Operations Management  1909"
    ]
  },
  "referenceLink": "https://www.us-cert.gov/ics/advisories/icsa-20-154-04",
  "serverity": "\u9ad8",
  "submitTime": "2020-04-29",
  "title": "\u591a\u6b3eABB\u4ea7\u54c1\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2020-8481 (GCVE-0-2020-8481)

Vulnerability from cvelistv5 – Published: 2020-04-29 01:30 – Updated: 2024-08-04 10:03

Summary

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-200 - Information Exposure

Assigner

ABB

References

URL

Tags

	https://search.abb.com/library/Download.aspx?Docu…	x_refsource_CONFIRM
	https://search.abb.com/library/Download.aspx?Docu…	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

ABB

Central Licensing System

Affected: 5.1 , < 5* (custom)

ABB	ABB Ability System 800xA	Affected: 5.1 Affected: 6.0 Affected: 6.1
ABB	Compact HMI	Affected: 5.1 Affected: 6.0
ABB	Control Builder Safe	Affected: 1.0 Affected: 1.1 Affected: 2.0
ABB	Symphony Plus S+ Operations	Affected: 3 , ≤ 3.2 (custom)
ABB	Symphony Plus S+ Engineering	Affected: 1.1 , ≤ 2.2 (custom)
ABB	Composer Harmony	Affected: 5.1 Affected: 6.0 Affected: 6.1
ABB	Composer Melody	Affected: 5.3 Affected: 6 , ≤ 6.3 (custom)
ABB	Harmony OPC Server Standalone	Affected: 6.0 Affected: 6.1 Affected: 7.0
ABB	Advant OCS Control Builder A	Affected: 1.3 Affected: 1.4
ABB	Composer CTK	Affected: 6.1 Affected: 6.2
ABB	AdvaBuild	Affected: 3.7 SP1 Affected: 3.7 SP2
ABB	OPC Server for Mod 300 (non-800xA)	Affected: 1.4
ABB	OPC Data Link	Affected: 2.1 Affected: 2.2
ABB	Knowledge Manager	Affected: 8.0 Affected: 9.0 Affected: 9.1
ABB	Manufacturing Operations Management	Affected: 1812 Affected: 1909
ABB	Advant OCS AC 100 OPS Server	Affected: 5.1 Affected: 6.0 Affected: 6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:03:45.868Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Central Licensing System",
          "vendor": "ABB",
          "versions": [
            {
              "lessThan": "5*",
              "status": "affected",
              "version": "5.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ABB Ability System 800xA",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            }
          ]
        },
        {
          "product": "Compact HMI",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "status": "affected",
              "version": "6.0"
            }
          ]
        },
        {
          "product": "Control Builder Safe",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "2.0"
            }
          ]
        },
        {
          "product": "Symphony Plus S+ Operations",
          "vendor": "ABB",
          "versions": [
            {
              "lessThanOrEqual": "3.2",
              "status": "affected",
              "version": "3",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Symphony Plus S+ Engineering ",
          "vendor": "ABB",
          "versions": [
            {
              "lessThanOrEqual": "2.2",
              "status": "affected",
              "version": "1.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Composer Harmony",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            }
          ]
        },
        {
          "product": "Composer Melody ",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThanOrEqual": "6.3",
              "status": "affected",
              "version": "6",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Harmony OPC Server Standalone",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "7.0"
            }
          ]
        },
        {
          "product": "Advant OCS Control Builder A",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "1.4"
            }
          ]
        },
        {
          "product": "Composer CTK",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            }
          ]
        },
        {
          "product": "AdvaBuild",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "3.7 SP1"
            },
            {
              "status": "affected",
              "version": "3.7 SP2"
            }
          ]
        },
        {
          "product": "OPC Server for Mod 300 (non-800xA)",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "1.4"
            }
          ]
        },
        {
          "product": "OPC Data Link",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "2.1"
            },
            {
              "status": "affected",
              "version": "2.2"
            }
          ]
        },
        {
          "product": "Knowledge Manager",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "8.0"
            },
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            }
          ]
        },
        {
          "product": "Manufacturing Operations Management",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "1812"
            },
            {
              "status": "affected",
              "version": "1909"
            }
          ]
        },
        {
          "product": "Advant  OCS AC 100 OPS Server",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "For ABB products ABB Ability\u2122 System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability\u2122 System 800xA/ Advant\u00ae OCS Control Builder A 1.3 and 1.4, Advant\u00ae OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T01:30:56",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ABB Central Licensing System - Information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@ch.abb.com",
          "ID": "CVE-2020-8481",
          "STATE": "PUBLIC",
          "TITLE": "ABB Central Licensing System - Information disclosure"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Central Licensing System",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_name": "5",
                            "version_value": "5.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ABB Ability System 800xA",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Compact HMI",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Control Builder Safe",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "1.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Symphony Plus S+ Operations",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "3",
                            "version_value": "3.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Symphony Plus S+ Engineering ",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "1.1",
                            "version_value": "2.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Composer Harmony",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Composer Melody ",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.3"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "6",
                            "version_value": "6.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Harmony OPC Server Standalone",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Advant OCS Control Builder A",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1.3"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "1.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Composer CTK",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "6.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "AdvaBuild",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "3.7 SP1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.7 SP2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "OPC Server for Mod 300 (non-800xA)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "OPC Data Link",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "2.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Knowledge Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "8.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "9.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "9.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Manufacturing Operations Management",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1812"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "1909"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Advant  OCS AC 100 OPS Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "6.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ABB"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "For ABB products ABB Ability\u2122 System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability\u2122 System 800xA/ Advant\u00ae OCS Control Builder A 1.3 and 1.4, Advant\u00ae OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200 Information Exposure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
              "refsource": "CONFIRM",
              "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
            },
            {
              "name": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
              "refsource": "CONFIRM",
              "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2020-8481",
    "datePublished": "2020-04-29T01:30:56",
    "dateReserved": "2020-01-30T00:00:00",
    "dateUpdated": "2024-08-04T10:03:45.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-32228

CVE-2020-8481 (GCVE-0-2020-8481)

Tags

Sightings

Nomenclature