CVE-2020-13499
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstancePath in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.
Se presenta una vulnerabilidad de inyección SQL en la funcionalidad web service del archivo CHaD.asmx de eDNA Enterprise Data Historian versión 3.0.1.2/7.5.4989.33053. Unas peticiones web SOAP especialmente diseñadas pueden causar inyecciones SQL resultando en un compromiso de los datos. El parámetro InstancePath en el archivo CHaD.asmx es vulnerable a ataques de inyección SQL no autenticados.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-05-26 CVE Reserved
- 2020-09-24 CVE Published
- 2024-04-21 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://us-cert.cisa.gov/ics/advisories/icsa-20-254-01 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1106 | 2024-08-04 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Aveva Search vendor "Aveva" | Edna Enterprise Data Historian Search vendor "Aveva" for product "Edna Enterprise Data Historian" | 3.0.1.2\/7.5.4989.33053 Search vendor "Aveva" for product "Edna Enterprise Data Historian" and version "3.0.1.2\/7.5.4989.33053" | - |
Affected
|