CVE-2020-16240 - GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerabi

CVE-2020-16240

Summary

GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be downloaded in JavaScript object notation (JSON) format by users who should not have access to such functionality. An attacker can download sensitive data related to user accounts without having the proper privileges.

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-266-01

Vulnerable Configurations

cpe:2.3:a:ge:asset_performance_management_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:ge:asset_performance_management_classic:*:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 05-10-2020 - 13:46)
Impact:
Exploitability:

CWE

CWE-639

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

misc

https://us-cert.cisa.gov/ics/advisories/icsa-20-266-01

Last major update

05-10-2020 - 13:46

Published

23-09-2020 - 14:15

Last modified

05-10-2020 - 13:46