PT-2020-15807 · Schneider Electric · S+ Operations

Published 2020-12-22 · Updated 2021-10-07 · CVE-2020-24683

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions S+ Operations versions 2.1 SP1 and earlier

Description The issue concerns the use of client-side authentication in the affected versions, which is less secure than server-side validation. This allows unauthorized actors to bypass authentication and make unauthorized connections to the server application if the network communication or endpoints are not protected.

Recommendations For versions 2.1 SP1 and earlier, consider implementing server-side validation for user authentication to enhance security. As a temporary workaround, ensure that network communication and endpoints for these applications are properly protected to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-602

CWE-669

CWE-305

Related Identifiers

CVE-2020-24683

Affected Products

S+ Operations

References · 6

• https://osv.dev/vulnerability/CVE-2020-24683 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24683 · Security Note
• https://t.me/cvenotify/7595 · Telegram Post
• https://t.me/cibsecurity/21200 · Telegram Post
• https://t.me/cvenotify/7605 · Telegram Post