CodeMeter
At a glance
- Source
- NVD
- EPSS
- EPSS 0.64 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- icscert
- NVD status
- Modified
Description
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.
Weaknesses (CWE)
- CWE-346 — Origin Validation Error
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-6655
- GCVE · GCVE-0-2020-14519
CERT-FR advisories
- CERTFR-2020-AVI-643 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
- CERTFR-2020-AVI-550 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:wibu:codemeter:*:*:*:*:*:*:*:*< 7.00
Affected products
| Product | Versions |
|---|---|
| CodeMeter | affected All versions prior to 7.00, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |