CVE Vulnerability

CVE-2020-13505

Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1108 Exploit Technical Description
Configurations

Configuration 1

cpe:2.3:a:aveva:edna_enterprise_data_historian:3.0.1.2/7.5.4989.33053:*:*:*:*:*:*:*
Information

Published : 2020-09-24 03:15

Updated : 2020-09-25 03:04

NVD link : CVE-2020-13505

Mitre link : CVE-2020-13505

Products Affected
No products.
CWE
CWE-89