CVE-2020-13499: SQL Injection

Published Sep 24, 2020

Updated

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstancePath in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.

Affected Software

2 affected components

AVEVA Edna Enterprise Data Historian=3.0.1.2\/7.5.4989.33053

AVEVA Enterprise Data Management Web v2019 and prior

Event History

Sep 24, 2020

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-254-01

Frequently Asked Questions

What is the vulnerability ID for this SQL injection vulnerability?

The vulnerability ID for this SQL injection vulnerability is CVE-2020-13499.

What software is affected by this vulnerability?

The eDNA Enterprise Data Historian version 3.0.1.2/7.5.4989.33053 is affected by this vulnerability.

What is the severity of CVE-2020-13499?

The severity of CVE-2020-13499 is critical with a CVSS score of 9.8.

How can the SQL injection vulnerability be exploited?

The SQL injection vulnerability can be exploited by sending specially crafted SOAP web requests.

Are there any references or additional information available for CVE-2020-13499?

Yes, you can find more information about CVE-2020-13499 at the following references: [Reference 1](https://talosintelligence.com/vulnerability_reports/TALOS-2020-1106) and [Reference 2](https://us-cert.cisa.gov/ics/advisories/icsa-20-254-01).