CVE-2020-13499: Aveva Edna Enterprise Data Historian

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstancePath in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.

Affected products

• Aveva Edna Enterprise Data Historian: version 3.0.1.2/7.5.4989.33053 only

Published 2020-09-24. Last modified 2026-06-17.