CVE-2020-13499

🗓️ 24 Sep 2020 14:16:30Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 61 Views🌐 WEB

An SQL injection vulnerability in eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053 allows unauthenticated attacks

Reporter	Title	Published	Views	Family All 9
Check Point Advisories	Aveva eDNA Enterprise SQL Injection (CVE-2020-13499; CVE-2020-13500; CVE-2020-13501)	11 Oct 202000:00	–	checkpoint_advisories
Cvelist	CVE-2020-13499	24 Sep 202014:16	–	cvelist
EUVD	EUVD-2020-5746	7 Oct 202500:30	–	euvd
ICS	AVEVA Enterprise Data Management Web	10 Sep 202000:00	–	ics
NVD	CVE-2020-13499	24 Sep 202015:15	–	nvd
OSV	CVE-2020-13499	24 Sep 202015:15	–	osv
Prion	Sql injection	24 Sep 202015:15	–	prion
RedhatCVE	CVE-2020-13499	5 Feb 202513:45	–	redhatcve
Talos	Aveva eDNA Enterprise data historian CHaD.asmx multiple SQL injection vulnerabilities	23 Sep 202000:00	–	talos

NVD

Vulners

Node

aveva edna_enterprise_data_historianMatch3.0.1.2/7.5.4989.33053

[
  {
    "product": "Aveva",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Aveva eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2020-1106
us-cert	www.us-cert.cisa.gov/ics/advisories/icsa-20-254-01

Parameter	Position	Path	Description	CWE
InstancePath	request body	CHaD.asmx	SOAP parameter InstancePath is vulnerable to unauthenticated SQL injection in CHaD.asmx endpoint.	CWE-89

21 Nov 2024 05:01Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

CVSS 39.8

EPSS0.00282

CWE-89