high8.8
CVE-2020-24674
In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected.
Impact
In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Abb | Symphony \+ Historian | Versions 3.0, 3.1 |
| Abb | Symphony \+ Operations | Versions 1.1, 2.0, 2.1, 3.0, 3.1, 3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch