CVE-2020-9049
5.3
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 1.6 / Impact: 3.6
Source: NVD
Description
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.
Affected (2)
Products: Johnsoncontrols: C Cure Web, Victor Web
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 2.90 | |
| Up to 5.6 |
Related CWEs
CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
References (10)
Source: productsecurity@jci.com
PatchThird Party AdvisoryUS Government Resource
Source: productsecurity@jci.com
PatchThird Party AdvisoryUS Government Resource
Source: productsecurity@jci.com
PatchThird Party AdvisoryUS Government Resource
Source: productsecurity@jci.com
PatchThird Party AdvisoryUS Government Resource
Source: productsecurity@jci.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.