CVE-2020-9049

A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.7 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.7^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:M/Au:N/C:N/I:N/A:C

Exploitability : 5.5 / Impact : 6.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01	Patch Third Party Advisory US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:johnsoncontrols:c-cure_web::::::::
	cpe:2.3:a:johnsoncontrols:victor_web::::::::

History

No history.

Information

Published : 2020-11-19 16:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-9049

Mitre link : CVE-2020-9049

CVE.ORG link : CVE-2020-9049

JSON object : View

Products Affected

johnsoncontrols

c-cure_web
victor_web

CWE

CWE-287

Improper Authentication

CWE-285

Improper Authorization

{"id": "CVE-2020-9049", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "productsecurity@jci.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.6}]}, "published": "2020-11-19T16:15:11.173", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "productsecurity@jci.com"}, {"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "tags": ["Vendor Advisory"], "source": "productsecurity@jci.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "productsecurity@jci.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in specified versions of American Dynamics victor Web Client and Software House C\u2022CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack."}, {"lang": "es", "value": "Una vulnerabilidad en versiones espec\u00edficas de American Dynamics victor Web Client y Software House C\u2022CURE Web Client, podr\u00eda permitir a un atacante no autenticado en la red crear y firmar su propio JSON Web Token y usarlo para ejecutar un HTTP API Method sin la necesidad de una autorizaci\u00f3n de autenticaci\u00f3n. En determinadas circunstancias, un atacante podr\u00eda usar esto para afectar la disponibilidad del sistema al conducir un ataque de Denegaci\u00f3n de Servicio"}], "lastModified": "2020-12-04T15:18:38.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:johnsoncontrols:c-cure_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C1E9FAF-B52D-4ABE-8457-7CA79C0C5DBC", "versionEndIncluding": "2.90"}, {"criteria": "cpe:2.3:a:johnsoncontrols:victor_web:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E225100B-FAF2-403E-8443-D055A1BFBD23", "versionEndIncluding": "5.6"}], "operator": "OR"}]}], "sourceIdentifier": "productsecurity@jci.com"}