{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2020-11640 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2020-11640 yet. Limit exposure of the affected software until one is available.","what":"CVE-2020-11640 is a high-severity vulnerability in ABB Advant MOD 300 AdvaBuild, published on 23 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-11640 and fix it if it is affected.\n\nWhat it is: CVE-2020-11640 is a high-severity vulnerability in ABB Advant MOD 300 AdvaBuild, published on 23 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-11640 in the wild and no public exploit code.\n\nAffected product: ABB Advant MOD 300 AdvaBuild. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-11640/ (Markdown: https://insights.sbomify.com/CVE-2020-11640/index.md)","id":"CVE-2020-11640","markdown":"https://insights.sbomify.com/CVE-2020-11640/index.md","name":"CVE-2020-11640","record":{"aliases":["GHSA-6mjp-g2rf-hh5w"],"analysis":{"component_type":"ics_ot","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"ABB Advant MOD 300","requires_auth":"low_privilege","summary":"An attacker with command queue access can execute arbitrary executables on the AdvaBuild node, leading to privilege escalation.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"ABB","cpe":[{"product":"advabuild","vendor":"abb"}],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"description":"AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the\ncommand queue can use it to launch an attack by running any executable on the AdvaBuild node. The\nexecutables that can be run are not limited to AdvaBuild specific executables. \n\nImproper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Elevation of Privilege","id":"CVE-2020-11640","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"privilege_escalation","year":"2020"},"n_packages":0,"n_references":1,"next":{"headline":"SiteManager Local File Inclusion Vulnerability","id":"CVE-2020-11641"},"packages":[],"prev":{"headline":"Insufficient access control on Inter process communication,","id":"CVE-2020-11639"},"products":["Advant MOD 300 AdvaBuild"],"published":"2024-07-23","related":[{"cvss_score":7.8,"headline":"Insufficient access control on Inter process communication,","id":"CVE-2020-11639","kev_date_added":null,"published":"2024-07-23"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-04","vendors":["ABB"]},"summary":"An attacker with command queue access can execute arbitrary executables on the AdvaBuild node, leading to privilege escalation.","url":"https://insights.sbomify.com/CVE-2020-11640/"}