Critical ICSA-20-254-01 3 CVEs

AVEVA Enterprise Data Management Web

Published Sep 10, 2020 · Updated Sep 10, 2020

Vendor: AVEVA Product: Enterprise Data Management Web

Summary

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected device.

Vulnerabilities 3

Critical 9.8

CVE-2020-13499

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.…

Sep 24, 2020
Critical 9.8

CVE-2020-13500

SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2…

Sep 24, 2020
Critical 9.8

CVE-2020-13501

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.…

Sep 24, 2020

Revision history

2020-09-10 #1
ICSA-20-254-01 AVEVA Enterprise Data Management Web

References

ICS Advisory ICSA-20-254-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-254-01
Recommended Practices
https://www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B