Description
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstancePath in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Aveva | Aveva eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053 | — |
Advisories 1
- ICSA-20-254-01 AVEVA Enterprise Data Management Web CISA ICS & IT advisories · Sep 10, 2020