CVE-2020-13501: SQL Injection

Published Sep 24, 2020

Updated

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstanceName in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.

Affected Software

2 affected components

AVEVA Edna Enterprise Data Historian=3.0.1.2\/7.5.4989.33053

AVEVA Enterprise Data Management Web v2019 and prior

Event History

Sep 24, 2020

CVE Published

via MITRE·02:39 PM

Data Sourced

via MITRE·02:39 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-254-01

Frequently Asked Questions

What is CVE-2020-13501?

CVE-2020-13501 is an SQL injection vulnerability in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.

What is the severity of CVE-2020-13501?

The severity of CVE-2020-13501 is critical with a CVSS score of 9.8.

How does CVE-2020-13501 affect Aveva Edna Enterprise Data Historian?

Aveva Edna Enterprise Data Historian version 3.0.1.2/7.5.4989.33053 is affected by CVE-2020-13501.

What is the CWE ID for CVE-2020-13501?

The CWE ID for CVE-2020-13501 is CWE-89.

How can I fix the CVE-2020-13501 vulnerability?

To fix the CVE-2020-13501 vulnerability, apply the necessary patches or updates provided by Aveva.