CVE-2020-8477CWE-489CWE-79

ABB System 800xA Information Manager Remote Code Execution

High · published April 22, 2020

CVSS v3.1
8.8
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01711 · 77.2th percentile
Weaknesses
CWE-489 · Active Debug Code; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-04-22T14:46Z
EPSS history
Timeline
  • 22 APR 14:46Z
    ABB System 800xA Information Manager Remote Code Execution
    cvelistv5