CVE-2020-9044

🗓️ 10 Mar 2020 20:15:22Reported by [email protected]Type

nvd

nvd🔗 web.nvd.nist.gov👁 8 Views

XXE vulnerability in Johnson Controls' Metasys family of products Web Services can lead to DoS attacks or ASCII server file harvesting

Reporter	Title	Published	Views	Family All 10
CNVD	Johnson Controls Metasys XML External Entity Injection Vulnerability	11 Mar 202000:00	–	cnvd
CVE	CVE-2020-9044	10 Mar 202019:28	–	cve
Cvelist	CVE-2020-9044 Metasys Improper Restriction of XML External Entity Reference	10 Mar 202019:28	–	cvelist
EUVD	EUVD-2020-29873	7 Oct 202500:30	–	euvd
ICS	Johnson Controls Metasys	10 Mar 202000:00	–	ics
OSV	CVE-2020-9044	10 Mar 202020:15	–	osv
Tenable Nessus	Johnsoncontrols Metasys Improper Restriction of XML External Entity Reference	10 Aug 202100:00	–	nessus
Tenable Nessus	Johnson Controls Metasys Improper Restriction of XML External Entity Reference (CVE-2020-9044)	7 Feb 202200:00	–	nessus
Prion	Xxe	10 Mar 202020:15	–	prion
RedhatCVE	CVE-2020-9044	5 Feb 202515:05	–	redhatcve

NVD

Node

johnsoncontrols metasys_application_and_data_serverRange≤10.1

OR

johnsoncontrols metasys_application_and_data_serverRange≤10.1lite

OR

johnsoncontrols metasys_extended_application_and_data_serverRange≤10.1

OR

johnsoncontrols metasys_lonworks_control_serverRange≤10.1

OR

johnsoncontrols metasys_open_application_serverMatch10.1

OR

johnsoncontrols metasys_open_data_serverRange≤10.1

OR

johnsoncontrols metasys_system_configuration_toolRange≤13.2

Node

johnsoncontrols nae55_firmwareMatch9.0.1

OR

johnsoncontrols nae55_firmwareMatch9.0.2

OR

johnsoncontrols nae55_firmwareMatch9.0.3

OR

johnsoncontrols nae55_firmwareMatch9.0.5

OR

johnsoncontrols nae55_firmwareMatch9.0.6

AND

johnsoncontrols nae55Match-

Node

johnsoncontrols nie55_firmwareMatch9.0.1

OR

johnsoncontrols nie55_firmwareMatch9.0.2

OR

johnsoncontrols nie55_firmwareMatch9.0.3

OR

johnsoncontrols nie55_firmwareMatch9.0.5

OR

johnsoncontrols nie55_firmwareMatch9.0.6

AND

johnsoncontrols nie55Match-

Node

johnsoncontrols nie59_firmwareMatch9.0.1

OR

johnsoncontrols nie59_firmwareMatch9.0.2

OR

johnsoncontrols nie59_firmwareMatch9.0.3

OR

johnsoncontrols nie59_firmwareMatch9.0.5

OR

johnsoncontrols nie59_firmwareMatch9.0.6

AND

johnsoncontrols nie59Match-

Node

johnsoncontrols nae85_firmwareRange≤10.1

AND

johnsoncontrols nae85Match-

Node

johnsoncontrols nie85_firmwareRange≤10.1

AND

johnsoncontrols nie85Match-

Node

johnsoncontrols nae55_firmwareMatch8.1

AND

johnsoncontrols nae55Match-

Node

johnsoncontrols ul_864_uukl_firmwareMatch8.1

AND

johnsoncontrols ul_864_uuklMatch-

Node

johnsoncontrols ord-c100-13_uuklc_firmwareMatch8.1

AND

johnsoncontrols ord-c100-13_uuklcMatch-

Source	Link
johnsoncontrols	www.johnsoncontrols.com/cyber-solutions/security-advisories
us-cert	www.us-cert.gov/ics/advisories/icsa-20-070-05

21 Nov 2024 05:39Current

8.4High risk

Vulners AI Score8.4

CVSS 26.4

CVSS 3.17.5 - 9.1

EPSS0.00269

xxe vulnerability johnson controls metasys web services dos attacks ascii server files.