by Kastro
Paper/Archive/CVE-2020-7480

CVE-2020-7480

schneider — A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could…

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.9.749 × 2015.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.

Affected

ProductAffectedFixed inSource
Andover Continuum (All versions)Andover Continuum (All versions)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refse.com/ww/en/download/document/SEVD-2020-070-04