In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History server) and ultimately write values to the controlled process.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Symphony_+_historian | Abb | 3.0 (including) | 3.0 (including) |
| Symphony_+_historian | Abb | 3.1 (including) | 3.1 (including) |
| Symphony_+_operations | Abb | 1.1 (including) | 1.1 (including) |
| Symphony_+_operations | Abb | 2.0 (including) | 2.0 (including) |
| Symphony_+_operations | Abb | 2.1-sp1 (including) | 2.1-sp1 (including) |
| Symphony_+_operations | Abb | 2.1-sp2 (including) | 2.1-sp2 (including) |
| Symphony_+_operations | Abb | 3.0 (including) | 3.0 (including) |
| Symphony_+_operations | Abb | 3.1 (including) | 3.1 (including) |
| Symphony_+_operations | Abb | 3.2 (including) | 3.2 (including) |
| Symphony_+_operations | Abb | 3.3 (including) | 3.3 (including) |