XSS in Abb 800xa Information Manager
CVE-2020-8477
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (76.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 76.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: +0.000
Affected products
- Abb 800xa Information Manager — versions 5.1, 6.1
- Abb System 800xa Information Manager — versions 5, 6.0, 6.1
Weakness classification (CWE)
References
- search.abb.com/library/Download.aspx (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-8477?
- CVE-2020-8477 is a high-severity vulnerability in Abb 800xa Information Manager, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2020-04-22.
- How severe is CVE-2020-8477?
- High severity. CVSS v3 base score is 8.8 out of 10.