CVE-2020-28209
CVSS V2 Medium 4.4
CVSS V3 High 7
Description
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location.
Overview
- CVE ID
- CVE-2020-28209
- Assigner
- cybersecurity@se.com
- Vulnerability Status
- Analyzed
- Published Version
- 2020-11-19T22:15:13
- Last Modified Date
- 2022-01-31T19:33:27
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:a:schneider-electric:enterprise_server_installer:*:*:*:*:*:*:*:* | 1 | OR | 1.9 | 3.1 |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:M/Au:N/C:P/I:P/A:P
- Access Vector
- LOCAL
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 4.4
- Severity
- MEDIUM
- Exploitability Score
- 3.4
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- HIGH
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7
- Base Severity
- HIGH
- Exploitability Score
- 1
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://www.se.com/ww/en/download/document/SEVD-2020-315-04/ | Patch Product Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-28209 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28209 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 06:35:38 | Added to TrackCVE | |||
| 2022-12-05 17:06:47 | cybersecurity@schneider-electric.com | cybersecurity@se.com | CVE Assigner | updated |
| 2022-12-05 17:06:47 | 2020-11-19T22:15Z | 2020-11-19T22:15:13 | CVE Published Date | updated |
| 2022-12-05 17:06:47 | 2022-01-31T19:33:27 | CVE Modified Date | updated | |
| 2022-12-05 17:06:47 | Analyzed | Vulnerability Status | updated |