« Volver al listado

CVE-2020-10599

Estado: ModificadaCrítica (9.8)—

VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buffer overflow, which may lead to a denial-of-service condition and execution of arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Visam — Vbase EditorVisam — Vbase Web-remote

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-10599",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "VISAM",
          "product": "VBASE Editor",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0.2"
            }
          ]
        },
        {
          "vendor": "VISAM",
          "product": "VBASE Web-Remote Module",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-03T18:15:12.937",
  "references": [
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-084-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-084-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buffer overflow, which may lead to a denial-of-service condition and execution of arbitrary code."
    },
    {
      "lang": "es",
      "value": "VISAM VBASE Editor versión 11.5.0.2 y VBASE Web-Remote Module pueden permitir que un componente ActiveX vulnerable sea explotado, resultando en un desbordamiento del búfer, lo que puede conllevar a una condición de denegación de servicio y una ejecución de código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T02:48:04.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:visam:vbase_editor:11.5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD0FE954-EE09-4D90-8016-B93E346171EB"
            },
            {
              "criteria": "cpe:2.3:a:visam:vbase_web-remote:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE669CE9-41BB-494E-9102-BD647345BFB0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}