CVE-2020-9049
Summary
| CVE | CVE-2020-9049 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-11-19 16:15:00 UTC |
| Updated | 2020-12-04 15:18:00 UTC |
| Description | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack. |
Risk And Classification
Problem Types: CWE-287
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Johnsoncontrols | C-cure Web | All | All | All | All |
| Application | Johnsoncontrols | Victor Web | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Product Security Advisories | CONFIRM | www.johnsoncontrols.com | Vendor Advisory |
| Johnson Controls Sensormatic Electronics American Dynamics victor Web Client | CISA | CERT | us-cert.cisa.gov | Patch, Third Party Advisory, US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Joachim Kerschbaumer reported this vulnerability to Johnson Controls, Inc.
There are currently no legacy QID mappings associated with this CVE.