Lucene search

JciCVE-2020-9050

HistoryFeb 19, 2021 - 6:15 p.m.

CVE-2020-9050

2021-02-1918:15:11

CWE-22

jci

web.nvd.nist.gov

cve

2020

9050

path traversal

vulnerability

metasys reporting engine

mre

web services

remote attacker

unauthenticated

access

download

arbitrary files

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

70.3%

JSON

Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system.

Affected configurations

Nvd

Node

johnsoncontrolsmetasys_reporting_engineMatch2.0

johnsoncontrolsmetasys_reporting_engineMatch2.1

VendorProductVersionCPE
johnsoncontrolsmetasys_reporting_engine2.0cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.0:*:*:*:*:*:*:*
johnsoncontrolsmetasys_reporting_engine2.1cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
johnsoncontrols	metasys_reporting_engine	2.0	cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.0:::::::*
johnsoncontrols	metasys_reporting_engine	2.1	cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.1:::::::*

CNA Affected

[
  {
    "product": "Metasys Reporting Engine (MRE) Web Services versions 2.0 and 2.1",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "status": "affected",
        "version": "2.0"
      },
      {
        "status": "affected",
        "version": "2.1"
      }
    ]
  }
]

References

www.johnsoncontrols.com/cyber-solutions/security-advisories

www.us-cert.gov/ics/advisories/icsa-21-049-01

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

70.3%

JSON

Related for CVE-2020-9050