← Back to browse · API

CVE-2020-13501

Severity
CRITICAL
CVSS
9.8
EPSS
0.02912
Risk score
40.22
CISA KEV
No
PoC
No
Published
2020-09-24
Modified
2024-08-04
First seen
2026-08-07
Aliases
EUVD-2020-5748, GHSA-65W4-P422-2R48
Products
n/a:Aveva Aveva eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053
Sources
euvd EUVD-2020-5748

Description

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstanceName in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.

References