CVE-2020-9050 - Vulnerability Details - OpenCVE

Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Johnsoncontrols	Metasys Reporting Engine

Configuration 1 [-]

OR	cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.0:::::::*
	cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.1:::::::*

No data.

References

Link	Providers
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
https://www.us-cert.gov/ics/advisories/icsa-21-049-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2021-02-19T17:12:36.690522Z

Updated: 2024-09-16T16:38:28.543Z

Reserved: 2020-02-18T00:00:00

Link: CVE-2020-9050

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-02-19T18:15:11.720

Modified: 2024-11-21T05:39:54.370

Link: CVE-2020-9050

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Metasys Reporting Engine (MRE) Web Services versions 2.0 and 2.1", "vendor": "Johnson Controls", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}]}], "credits": [{"lang": "en", "value": "TIM Security Team Red Research"}], "datePublic": "2021-02-18T00:00:00", "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "CWE 22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-19T17:12:36", "orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "https://www.us-cert.gov/ics/advisories/icsa-21-049-01"}], "solutions": [{"lang": "en", "value": "\u2022 Upgrade to MRE v2.2 or later.\n\u2022 Customers with licenses for MRE should contact their local branch office for remediation."}], "source": {"discovery": "EXTERNAL"}, "title": "Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productsecurity@jci.com", "DATE_PUBLIC": "2021-02-18T20:00:00.000Z", "ID": "CVE-2020-9050", "STATE": "PUBLIC", "TITLE": "Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Metasys Reporting Engine (MRE) Web Services versions 2.0 and 2.1", "version": {"version_data": [{"version_affected": "=", "version_value": "2.0"}, {"version_affected": "=", "version_value": "2.1"}]}}]}, "vendor_name": "Johnson Controls"}]}}, "credit": [{"lang": "eng", "value": "TIM Security Team Red Research"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE 22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "references": {"reference_data": [{"name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "refsource": "CONFIRM", "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "refsource": "CERT", "url": "https://www.us-cert.gov/ics/advisories/icsa-21-049-01"}]}, "solution": [{"lang": "en", "value": "\u2022 Upgrade to MRE v2.2 or later.\n\u2022 Customers with licenses for MRE should contact their local branch office for remediation."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:19:20.011Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"name": "ICS-CERT Advisory", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "https://www.us-cert.gov/ics/advisories/icsa-21-049-01"}]}]}, "cveMetadata": {"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "assignerShortName": "jci", "cveId": "CVE-2020-9050", "datePublished": "2021-02-19T17:12:36.690522Z", "dateReserved": "2020-02-18T00:00:00", "dateUpdated": "2024-09-16T16:38:28.543Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "6C59B6C9-D46F-4F83-BC18-BFD8D9F61F74", "vulnerable": true}, {"criteria": "cpe:2.3:a:johnsoncontrols:metasys_reporting_engine:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "9464F78C-70E2-4B9A-AB6D-466B0BA95235", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system."}, {"lang": "es", "value": "Una vulnerabilidad Salto de Ruta se presenta en Metasys Reporting Engine (MRE) Web Services que podr\u00eda permitir a un atacante remoto no autenticado acceder y descargar archivos arbitrarios del sistema"}], "id": "CVE-2020-9050", "lastModified": "2024-11-21T05:39:54.370", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "productsecurity@jci.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-19T18:15:11.720", "references": [{"source": "productsecurity@jci.com", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "productsecurity@jci.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-21-049-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-21-049-01"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}