CVE-2020-12000

The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.us-cert.gov/ics/advisories/icsa-20-147-01	Third Party Advisory US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-147-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:inductiveautomation:ignition_gateway::::::::
	cpe:2.3:a:inductiveautomation:ignition_gateway::::::::

History

21 Nov 2024, 04:59

Type	Values Removed	Values Added
References	~~() https://www.us-cert.gov/ics/advisories/icsa-20-147-01 - Third Party Advisory, US Government Resource~~	() https://www.us-cert.gov/ics/advisories/icsa-20-147-01 - Third Party Advisory, US Government Resource

Information

Published : 2020-06-09 18:15

Updated : 2024-11-21 04:59

NVD link : CVE-2020-12000

Mitre link : CVE-2020-12000

CVE.ORG link : CVE-2020-12000

JSON object : View

Products Affected

inductiveautomation

ignition_gateway

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2020-12000", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-06-09T18:15:10.933", "references": [{"url": "https://www.us-cert.gov/ics/advisories/icsa-20-147-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-20-147-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information."}, {"lang": "es", "value": "El producto afectado es vulnerable al manejo de datos serializados. El problema resulta de la falta de una comprobaci\u00f3n apropiada de los datos suministrados por el usuario, lo que puede resultar en una deserializaci\u00f3n de datos no confiables en Ignition 8 Gateway (versiones anteriores a 8.0.10) y Ignition 7 Gateway (versiones anteriores a la 7.9.14), permitiendo a un atacante obtener informaci\u00f3n confidencial"}], "lastModified": "2024-11-21T04:59:05.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:inductiveautomation:ignition_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A080348-81C5-4DE0-8127-379242A59B2A", "versionEndExcluding": "7.9.14", "versionStartIncluding": "7.2.4.48"}, {"criteria": "cpe:2.3:a:inductiveautomation:ignition_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D54DBE1-0273-41EF-AC65-611E74CD00FA", "versionEndExcluding": "8.0.10", "versionStartIncluding": "8.0"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}