SB2020061907 - Multiple vulnerabilities in Rockwell Automation FactoryTalk View SE

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020061907

SB2020061907 - Multiple vulnerabilities in Rockwell Automation FactoryTalk View SE

Published: June 19, 2020

Security Bulletin ID SB2020061907
Severity
Medium
Patch available
NO
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-12028)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions within certain handlers. A remote authenticated attacker can utilize those handlers to interact with the data on the remote endpoint.


2) Information disclosure (CVE-ID: CVE-2020-12027)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote authenticated attacker can gain unauthorized access to sensitive information on the system, such as the hostnames and file paths for certain files within the system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References