CVE Vulnerability

CVE-2020-9049

A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.

5.7 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 5.5 / Impact : 6.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:johnsoncontrols:c-cure_web:*:*:*:*:*:*:*:*
cpe:2.3:a:johnsoncontrols:victor_web:*:*:*:*:*:*:*:*
Information

Published : 2020-11-19 04:15

Updated : 2020-12-04 03:18

NVD link : CVE-2020-9049

Mitre link : CVE-2020-9049

Products Affected
No products.
CWE
CWE-287