CVE-2020-16240

2020-09-2313:06:07

CWE-639

icscert

www.cve.org

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.6%

JSON

GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be downloaded in JavaScript object notation (JSON) format by users who should not have access to such functionality. An attacker can download sensitive data related to user accounts without having the proper privileges.

CNA Affected

[
  {
    "product": "GE Digital APM Classic",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 4.4 and prior"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-20-266-01