PT-2024-8943 · Advabuild · Advabuild

Published 2024-07-18 · Updated 2024-07-24 · CVE-2020-11640

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: AdvaBuild versions 3.0 through 3.7 SP2

Description: The issue is related to insufficient protection of the command queue in AdvaBuild, allowing a remote attacker to exploit it and run any executable on the AdvaBuild node. The executables that can be run are not limited to AdvaBuild specific executables. This is an Improper Privilege Management issue.

Recommendations: For AdvaBuild versions 3.0 through 3.7 SP2, consider restricting access to the command queue to prevent unauthorized execution of executables until a patch is available. As a temporary workaround, limit the privileges of the AdvaBuild node to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2024-10622

CVE-2020-11640

Affected Products

Advabuild

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-11640 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200044199.882581162.1721753430-284724496.1718609177 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11640 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10622 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200044199.882581162.1721753430-284724496.1718609177 · Note
• https://t.me/cvenotify/87153 · Telegram Post
• https://t.me/cvedetector/1523 · Telegram Post