TI-2020-11371 Aliases CVE-2020-14520 GHSA-67jg-mxq3-434p

Missing authorization in Ignition 8

LOW 35CWE-862Published 2020-07-31 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The affected product is vulnerable to an information leak, which may allow an attacker to obtain sensitive information on the Ignition 8 (all versions prior to 8.0.13).

Why it matters now

EPSS 0.01152 67th percentileScored 2026-11-07

Fix Fixed Ignition 8: 8.0.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Ignition 8	before 8.0.13	8.0.13	Patch available	CNA

Ignition 8 Vendor— Affected before 8.0.13 Fixed in 8.0.13 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:inductiveautomation:ignition_gateway::::::::	8.0 to before 8.0.13	Vulnerable	Inductive Automation

cpe:2.3:a:inductiveautomation:ignition_gateway:*:*:*:*:*:*:*:* Versions 8.0 to before 8.0.13 Vulnerable ·Inductive Automation

Remediation

Fix · CNA Ignition 8 Fixed in 8.0.13

Timeline

2026-10-02 Threatist record created from CVE-2020-14520
2026-10-03 Alias added: GHSA-67jg-mxq3-434p

References

Advisory 1

https://us-cert.cisa.gov/ics/advisories/icsa-20-212-01

TI-2020-08556 Deserialization of untrusted data in Ignition 8 Gateway CVSS 3.1HIGH 7.5
TI-2020-09663 Missing authentication in Ignition 8 Gateway CVSS 3.1HIGH 7.5
TI-2020-09659 Deserialization of untrusted data in Ignition 8 Gateway CVSS 3.1HIGH 7.5
TI-2020-08553 Improper access control in Ignition 8 Gateway CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences