CVE-2020-24683: abb abb ability™ symphony® plus operations

Vulnerability summary

CVE-2020-24683 is a critical (CVSS 9.8) vulnerability in abb abb ability™ symphony® plus operations. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.6% of scored vulnerabilities.

Timeline

1. 22-12-2020
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.

• CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
• CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
• CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.