PT-2020-6878 · Abb+1 · Abb Esoms+1

Published 2020-02-17 · Updated 2023-05-16 · CVE-2019-19092

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABB eSOMS versions 4.0 to 6.0.3

Description The issue is related to the ASP.NET Viewstate component of the ABB eSOMS software, which lacks authentication for a critical function. This could allow a remote attacker to disclose protected information. The software uses ASP.NET Viewstate without a Message Authentication Code (MAC), meaning alterations to Viewstate might not be noticed.

Recommendations For ABB eSOMS versions 4.0 to 6.0.3, consider disabling the use of ASP.NET Viewstate until a patch is available, or apply configuration changes to include a Message Authentication Code (MAC) for Viewstate to prevent unnoticed alterations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

CWE-16

Related Identifiers

BDU:2023-03053

CVE-2019-19092

Affected Products

Abb Esoms

Asp.Net

References · 7

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19092 · Security Note
• https://bdu.fstec.ru/vul/2023-03053 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19092 · Vendor Advisory
• https://t.me/cibsecurity/10966 · Telegram Post
• https://t.me/cvenotify/2381 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch · Note