VULNERABILITY INTELLIGENCE
CVE-2020-9049
CVSS score7.1 HIGH
EPSS probability0.53%
CISA KEVNot currently listed
Published2020-11-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Description
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.
Weakness classification
- productsecurity@jci.com: CWE-285
- nvd@nist.gov: CWE-287
Primary references
- productsecurity@jci.com — Patch, Third Party Advisory, US Government Resource
- productsecurity@jci.com — Patch, Third Party Advisory, US Government Resource
- productsecurity@jci.com — Patch, Third Party Advisory, US Government Resource
- productsecurity@jci.com — Patch, Third Party Advisory, US Government Resource
- productsecurity@jci.com — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory