Vulnerability · Published Mar 23, 2020 · Assigned by schneider
CVE-2020-7480
Critical 9.8
In plain English
A critical-severity code injection in Andover Continuum (All versions). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.5%top 25.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Andover Continuum (All versions) | Andover Continuum (All versions) |
Weakness: CWE-94
References
- https://www.se.com/ww/en/download/document/SEVD-2020-070-04/ x_refsource_MISC