Vulnerability Details CVE-2020-26869
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.017
EPSS Ranking 73.8%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://www.pcvuesolutions.com/security
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://www.pcvuesolutions.com/security
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
Products affected by CVE-2020-26869
-
cpe:2.3:a:arcinfo:pcvue:10.0
-
cpe:2.3:a:arcinfo:pcvue:12.0.0
-
cpe:2.3:a:arcinfo:pcvue:12.0.10
-
cpe:2.3:a:arcinfo:pcvue:12.0.11
-
cpe:2.3:a:arcinfo:pcvue:12.0.12
-
cpe:2.3:a:arcinfo:pcvue:12.0.13
-
cpe:2.3:a:arcinfo:pcvue:12.0.14
-
cpe:2.3:a:arcinfo:pcvue:12.0.15
-
cpe:2.3:a:arcinfo:pcvue:12.0.16
-
cpe:2.3:a:arcinfo:pcvue:12.0.7
-
cpe:2.3:a:arcinfo:pcvue:12.0.8
-
cpe:2.3:a:arcinfo:pcvue:12.0.9
-
cpe:2.3:a:arcinfo:pcvue:8.10