CVE-2020-8477

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-489

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-84783.3Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC CVE-2020-84799.8For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 an CVE-2020-84819.8For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Contro CVE-2020-84825.5Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privil CVE-2020-84847.8Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacke CVE-2020-84857.8Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an att CVE-2020-84867.8Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker a CVE-2020-84877.8Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker a CVE-2020-84887.8Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables a CVE-2020-84897.8Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) ena CVE-2020-84926.5Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct CVE-2020-84934.8A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fiel