CVE-2020-13500

CRITICAL 9.8CVE-2020-13500 · Published 24/09/2020 · updated 17/06/2026

In short

CVE-2020-13500 is a CRITICAL (CVSS 9.8) vulnerability affecting edna enterprise data historian (aveva).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
edna enterprise data historian aveva	`= 3.0.1.2/7.5.4989.33053`	No fix yet

Description

SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter ClassName in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.

References

talosintelligence.com/vulnerability_reports/TALOS-2020-1106 · Exploit
us-cert.cisa.gov/ics/advisories/icsa-20-254-01 · Third Party Advisory

More vulnerabilities in edna enterprise data historian

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

edna enterprise data historian

aveva

= 3.0.1.2/7.5.4989.33053

No fix yet

Description

More vulnerabilities in edna enterprise data historian

See all →