CVE-2020-24673: SQL Injection in Symphony Plus

Published Dec 22, 2020

Updated

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.

Affected Software

10 affected components

ABB Symphony \+ Historian=3.0

ABB Symphony \+ Historian=3.1

ABB Symphony \+ Operations=1.1

ABB Symphony \+ Operations=2.0

ABB Symphony \+ Operations=2.1-sp1

ABB Symphony \+ Operations=2.1-sp2

ABB Symphony \+ Operations=3.0

ABB Symphony \+ Operations=3.1

ABB Symphony \+ Operations=3.2

ABB Symphony \+ Operations=3.3

Event History

Dec 22, 2020

CVE Published

via MITRE·09:21 PM

Data Sourced

via MITRE·09:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-24673?

CVE-2020-24673 is considered a critical vulnerability due to its potential for SQL injection attacks that can lead to unauthorized database access and manipulation.

How do I fix CVE-2020-24673?

To address CVE-2020-24673, update the affected ABB Symphony+ Operations and Symphony+ Historian software to the latest versions provided by ABB.

What types of software are affected by CVE-2020-24673?

CVE-2020-24673 affects ABB Symphony+ Operations versions 1.1 to 3.3 and ABB Symphony+ Historian versions 3.0 and 3.1.

What are the potential impacts of exploiting CVE-2020-24673?

Exploitation of CVE-2020-24673 can lead to unauthorized data access, modification of database records, and execution of administrative operations on the database.

Is CVE-2020-24673 easy to exploit?

Yes, CVE-2020-24673 can be exploited with relative ease through SQL injection techniques, making immediate mitigation essential.