PT-2020-3472 · Abb · Abb System 800Xa Information Management

Published 2020-03-30 · Updated 2020-04-30 · CVE-2020-8477

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ABB System 800xA Information Manager versions 5.1, 6.0 through 6.0.3.2, 6.1

Description The issue arises from the incorrect inclusion of an auxiliary component in the installations, allowing an attacker to perform an XSS-like attack on an authenticated local user. This could potentially lead to the execution of arbitrary code. The vulnerability exists due to inadequate protection of the web page structure, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For versions 5.1, 6.0 through 6.0.3.2, 6.1, consider removing or disabling the auxiliary component to prevent exploitation until a proper fix is available. Restrict access to the vulnerable component of the Information Manager to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-489

CWE-79

Related Identifiers

BDU:2020-03796

CVE-2020-8477

Affected Products

Abb System 800Xa Information Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-8477 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA121232&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03796 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8477 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA121232&LanguageCode=en&DocumentPartId=&Action=Launch · Note