by Kastro
Paper/Archive/CVE-2020-13504

CVE-2020-13504

talos — Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.8.678 × 2013.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
AvevaAveva eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1108