Skip to content
OpenAdvisories
High ICSA-20-273-03 6 CVEs

B&R Automation SiteManager and GateManager

Published Sep 29, 2020 · Updated Sep 29, 2020

Vendor: B&R Industrial Automation Product: GateManager 4260 and 9250 Product: GateManager 8250 Product: SiteManager

Summary

Successful exploitation of these vulnerabilities could allow for arbitrary information disclosure, manipulation, and a denial-of-service condition.

Vulnerabilities 6

  • High 7.7
    CVE-2020-11641

    SiteManager Local File Inclusion Vulnerability

    A local file inclusion vulnerability in B&R SiteManager versions <9.2.620236042 allows authenticated users to read sensitive files from SiteManager instances.

    B&R SiteManager
  • High 7.7
    CVE-2020-11642

    SiteManager Denial of Service via Local File Inclusion Vulnerability

    The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager instances.

    B&R SiteManager
  • Medium 6.5
    CVE-2020-11643

    GateManager Information Disclosure Vulnerability

    An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view information of devices belonging to foreign domains.

    B&R GateManager
  • Medium 6.5
    CVE-2020-11644

    GateManager Audit Message Spoofing Vulnerability

    The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to generate fake audit log messages.

    B&R GateManager
  • Medium 6.5
    CVE-2020-11645

    GateManager Denial of Service Vulnerability

    A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to limit availability of GateManager instances.

    B&R GateManager
  • Medium 4.3
    CVE-2020-11646

    GateManager Log Information Disclosure Vulnerability

    A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view log information reserved for other users.

    B&R GateManager

Revision history

  1. #1

    ICSA-20-273-03 B&R Automation SiteManager and GateManager

References