Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2020-24673

SQL Injection in Symphony Plus

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ABB

Description

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ABB ABB Ability™ Symphony® Plus Operations

  • unspecified to < 3.3 Service Pack 1affected
  • unspecified to < 2.1 SP2 Rollup 2affected
  • unspecified to < 2.2affected

ABB ABB Ability™ Symphony® Plus Historian

  • unspecified to < 3.2affected

References