PT-2020-11885 · Eclipse+1 · Birt+2

Published 2020-08-14 · Updated 2020-08-21 · CVE-2020-10055

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Desigo CC versions 3.x through 4.x Desigo CC Compact versions 3.x through 4.x

Description A remote code execution issue has been identified in the affected applications due to a vulnerable 3rd party component, BIRT, used in the Advanced Reporting Engine. If this engine is enabled, a remote unauthenticated attacker could execute arbitrary commands on the server with SYSTEM privileges.

Recommendations For Desigo CC versions 3.x through 4.x, disable the Advanced Reporting Engine until a patch is available. For Desigo CC Compact versions 3.x through 4.x, disable the Advanced Reporting Engine until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-10055

Affected Products

Birt

Desigo Cc

Desigo Cc Compact

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10055 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06 · Patch
• https://osv.dev/vulnerability/CVE-2020-10055 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-786743.pdf · Vendor Advisory