variot - var-202004-2171

VAR-202004-2171

Vulnerability from variot - Updated: 2023-12-18 11:58

Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications. plural ABB System 800xA The product contains a vulnerability in improper permission assignment for critical resources.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. ABB OPCServer for AC800M is a product of Swiss ABB company. ABB OPCServer for AC800M is an OPC (OLE for Process Control) server for AC800M. Control Builder M Professional is a compact control builder. MMSServer for AC800M is a MMS server for AC800M.

A variety of ABB products have access control error vulnerabilities. Attackers can use this vulnerability to increase permissions and cause the system The function terminates and destroys the user's application

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202004-2171",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "control builder m",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "6.1"
      },
      {
        "model": "mms server",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "6.1"
      },
      {
        "model": "opc server",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "6.0"
      },
      {
        "model": "base software",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "abb",
        "version": "6.1"
      },
      {
        "model": "basesoftware",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "abb",
        "version": "for softcontrol 6.1"
      },
      {
        "model": "controlbuilderm",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "abb",
        "version": "for professional 6.1"
      },
      {
        "model": "mmsserver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "abb",
        "version": "6.1"
      },
      {
        "model": "opcserver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "abb",
        "version": "6.0"
      },
      {
        "model": "opcserver for ac800m",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "abb",
        "version": "\u003c=6.0"
      },
      {
        "model": "control builder mprofessional",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "abb",
        "version": "\u003c=6.0"
      },
      {
        "model": "mmsserver for ac800m",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "abb",
        "version": "\u003c=6.0"
      },
      {
        "model": "base software for softcontrol",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "abb",
        "version": "\u003c=6.0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:abb:control_builder_m:*:*:*:*:professional:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.1",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.1",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      }
    ]
  },
  "cve": "CVE-2020-8472",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "impactScore": 9.5,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 6.8,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-005094",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CNVD-2020-32229",
            "impactScore": 9.5,
            "integrityImpact": "COMPLETE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "VHN-186597",
            "impactScore": 9.5,
            "integrityImpact": "COMPLETE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:P/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-8472",
            "impactScore": 9.5,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "cybersecurity@ch.abb.com",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-005094",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-8472",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "cybersecurity@ch.abb.com",
            "id": "CVE-2020-8472",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-005094",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-32229",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202004-2357",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-186597",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-8472",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8472"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications. plural ABB System 800xA The product contains a vulnerability in improper permission assignment for critical resources.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. ABB OPCServer for AC800M is a product of Swiss ABB company. ABB OPCServer for AC800M is an OPC (OLE for Process Control) server for AC800M. Control Builder M Professional is a compact control builder. MMSServer for AC800M is a MMS server for AC800M. \n\r\n\r\nA variety of ABB products have access control error vulnerabilities. Attackers can use this vulnerability to increase permissions and cause the system The function terminates and destroys the user\u0027s application",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8472"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-8472",
        "trust": 3.2
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-20-154-01",
        "trust": 2.0
      },
      {
        "db": "JVN",
        "id": "JVNVU94921886",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1921",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8472",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8472"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "id": "VAR-202004-2171",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      }
    ],
    "trust": 1.51944445
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS",
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      }
    ]
  },
  "last_update_date": "2023-12-18T11:58:27.866000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SECURITY System 800xA Weak File Permissions",
        "trust": 0.8,
        "url": "https://search.abb.com/library/download.aspx?documentid=2paa121106\u0026languagecode=en\u0026documentpartid=\u0026action=launch"
      },
      {
        "title": "Patch for Multiple ABB product access control error vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/220855"
      },
      {
        "title": "Multiple ABB Product security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=118767"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-732",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-01"
      },
      {
        "trust": 1.7,
        "url": "https://search.abb.com/library/download.aspx?documentid=2paa121106\u0026languagecode=en\u0026documentpartid=\u0026action=launch"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-8472"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-8472"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu94921886/index.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1921/"
      },
      {
        "trust": 0.1,
        "url": "https://search.abb.com/library/download.aspx?documentid=2paa121106\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/732.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8472"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-8472"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-06-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "date": "2020-04-29T00:00:00",
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "date": "2020-04-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-8472"
      },
      {
        "date": "2020-06-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "date": "2020-04-29T00:15:12.140000",
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "date": "2020-04-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-06-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-32229"
      },
      {
        "date": "2020-05-14T00:00:00",
        "db": "VULHUB",
        "id": "VHN-186597"
      },
      {
        "date": "2020-05-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-8472"
      },
      {
        "date": "2020-06-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      },
      {
        "date": "2020-05-14T14:46:35.897000",
        "db": "NVD",
        "id": "CVE-2020-8472"
      },
      {
        "date": "2020-06-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  ABB System 800xA Vulnerability in improper permission assignment for critical resources in the product",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-005094"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-2357"
      }
    ],
    "trust": 0.6
  }
}

CVE-2020-8472 (GCVE-0-2020-8472)

Vulnerability from cvelistv5 – Published: 2020-04-28 23:52 – Updated: 2024-08-04 10:03

Summary

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

ABB

References

URL

Tags

https://search.abb.com/library/Download.aspx?Docu…

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

ABB

OPC Server for AC 800M

Affected: 6.0 and earlier

ABB	Control Builder M Professional	Affected: 6.1 and earlier
ABB	MMS Server for AC 800M	Affected: 6.1 and earlier
ABB	Base Software for SoftControl	Affected: 6.1 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:03:45.938Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OPC Server for AC 800M",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "6.0 and earlier"
            }
          ]
        },
        {
          "product": "Control Builder M Professional",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "6.1 and earlier"
            }
          ]
        },
        {
          "product": "MMS Server for AC 800M",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "6.1 and earlier"
            }
          ]
        },
        {
          "product": "Base Software for SoftControl",
          "vendor": "ABB",
          "versions": [
            {
              "status": "affected",
              "version": "6.1 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-28T23:52:41",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ABB System 800xA Weak File Permissions - different products",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@ch.abb.com",
          "ID": "CVE-2020-8472",
          "STATE": "PUBLIC",
          "TITLE": "ABB System 800xA Weak File Permissions - different products"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OPC Server for AC 800M",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.0 and earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Control Builder M Professional",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1 and earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "MMS Server for AC 800M",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1 and earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Base Software for SoftControl",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ABB"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-732 Incorrect Permission Assignment for Critical Resource"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
              "refsource": "CONFIRM",
              "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2020-8472",
    "datePublished": "2020-04-28T23:52:41",
    "dateReserved": "2020-01-30T00:00:00",
    "dateUpdated": "2024-08-04T10:03:45.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-202004-2171

CVE-2020-8472 (GCVE-0-2020-8472)

Tags

Sightings

Nomenclature