CVE-2020-8472
CVSS V2 Medium 6.8
CVSS V3 High 7.8
Description
Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.
Overview
- CVE ID
- CVE-2020-8472
- Assigner
- cybersecurity@ch.abb.com
- Vulnerability Status
- Analyzed
- Published Version
- 2020-04-29T00:15:12
- Last Modified Date
- 2020-05-14T14:46:35
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:a:abb:control_builder_m:*:*:*:*:professional:*:*:* | 1 | OR | 6.1 | |
| cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:* | 1 | OR | 6.1 | |
| cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:* | 1 | OR | 6.0 | |
| cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:* | 0 | OR | ||
| AND | ||||
| cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:* | 1 | OR | 6.1 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:L/Au:N/C:P/I:C/A:C
- Access Vector
- LOCAL
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 6.8
- Severity
- MEDIUM
- Exploitability Score
- 3.9
- Impact Score
- 9.5
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7.8
- Base Severity
- HIGH
- Exploitability Score
- 1.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-8472 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8472 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:32:20 | Added to TrackCVE | |||
| 2022-12-04 15:53:22 | 2020-04-29T00:15Z | 2020-04-29T00:15:12 | CVE Published Date | updated |
| 2022-12-04 15:53:22 | 2020-05-14T14:46:35 | CVE Modified Date | updated | |
| 2022-12-04 15:53:22 | Analyzed | Vulnerability Status | updated |