PT-2020-2738 · Emerson · Openenterprise

Roman Lozko · Published 2020-05-20 · Updated 2022-03-07 · CVE-2020-10632

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Emerson OpenEnterprise versions through 3.3.4

Description The issue is related to inadequate folder security permissions, which may allow modification of important configuration files. This could cause the system to fail or behave in an unpredictable manner. An attacker, acting remotely, could exploit this to cause a denial of service.

Recommendations For Emerson OpenEnterprise versions through 3.3.4, consider restricting access to important configuration files to prevent unauthorized modifications until a patch is available. As a temporary workaround, review and tighten folder security permissions to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-282

CWE-264

Related Identifiers

BDU:2020-02816

CVE-2020-10632

Affected Products

Openenterprise

References · 8

• https://bdu.fstec.ru/vul/2020-02816 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10632 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10632 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2020052018 · Note
• https://us-cert.gov/ics/advisories/icsa-20-140-02 · Note
• https://t.me/cvenotify/27365 · Telegram Post
• https://t.me/cvenotify/27843 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-20-140-02 · Note