Vulnerability in Ge Asset Performance Management Classic
CVE-2020-16244
GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data and then retrieve the actual passwords.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Ge Asset Performance Management Classic
- Ge Digital Apm Classic — versions Versions 4.4 and prior
Weakness classification (CWE)
References
- us-cert.cisa.gov/ics/advisories/icsa-20-266-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-16244?
- CVE-2020-16244 is a high-severity vulnerability in Ge Asset Performance Management Classic, classified under CWE-759. CVSS score: 7.2/10. Published 2020-09-23.
- How severe is CVE-2020-16244?
- High severity. CVSS v3 base score is 7.2 out of 10.