CVE-2020-9049 HIGH

CVE-2020-9049: victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability

Vendor Johnson Controls
Product victor Web Client version 5.6 and prior
Weakness CWE-285
Published November 19, 2020
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.

Key dates

02Disclosure timeline

November 19, 2020 CVE published
September 17, 2024 Record updated