CVE-2020-7480 Code injection in Andover Continuum (All versions)
An attacker can view files on the application server filesystem by interfering with XML data processing in Andover Continuum.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7480?
CVE-2020-7480 is a critical code injection vulnerability in Andover Continuum (All versions), published on 23 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
Weakness: CWE-94
Which versions are affected by CVE-2020-7480?
It affects 11 products.
Products include Schneider-Electric Andover Continuum 5720 Firmware, Schneider-Electric Andover Continuum 5740 Firmware, Schneider-Electric Andover Continuum 9200 Firmware, Schneider-Electric Andover Continuum 9680 Firmware, Schneider-Electric Andover Continuum 9702 Firmware, Schneider-Electric Andover Continuum 9900 Firmware and 5 more.
How do I fix CVE-2020-7480?
No fix has been published for CVE-2020-7480 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-7480 being exploited?
There is no known exploitation of CVE-2020-7480 in the wild and no public exploit code.
Other vulnerabilities in Andover Continuum (All versions)
Sources
Also known as GHSA-mqfj-275x-jhp4.