CVE-2020-24677: Insecure Web Service in Symphony Plus

Published Dec 22, 2020

Updated

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data.

Affected Software

10 affected components

ABB Symphony \+ Historian=3.0

ABB Symphony \+ Historian=3.1

ABB Symphony \+ Operations=1.1

ABB Symphony \+ Operations=2.0

ABB Symphony \+ Operations=2.1-sp1

ABB Symphony \+ Operations=2.1-sp2

ABB Symphony \+ Operations=3.0

ABB Symphony \+ Operations=3.1

ABB Symphony \+ Operations=3.2

ABB Symphony \+ Operations=3.3

Event History

Dec 22, 2020

CVE Published

via MITRE·09:16 PM

Data Sourced

via MITRE·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2020-24677.

What is the severity of CVE-2020-24677?

The severity of CVE-2020-24677 is high with a CVSS score of 8.8.

Which software versions are affected by CVE-2020-24677?

Abb Symphony + Historian versions 3.0 and 3.1, Abb Symphony + Operations versions 1.1, 2.0, 2.1-sp1, 2.1-sp2, 3.0, 3.1, 3.2, and 3.3 are affected by CVE-2020-24677.

What are the potential impacts of CVE-2020-24677?

CVE-2020-24677 can lead to possible code execution, privilege escalation, redirection of users, and unwanted data downloads.

Where can I find more information about CVE-2020-24677?

You can find more information about CVE-2020-24677 at the following references: [Reference 1](https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch), [Reference 2](https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch).