PT-2020-6882 · Abb · Abb Esoms

Published 2020-02-17 · Updated 2023-05-16 · CVE-2019-19090

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABB eSOMS versions 4.0 to 6.0.2

Description The issue is related to the absence of the Secure Flag in the HTTP response header, which may allow unencrypted connections to access cookie information, making it susceptible to eavesdropping. This could enable a remote attacker to gain unauthorized access to protected information.

Recommendations For ABB eSOMS versions 4.0 to 6.0.2, consider implementing HTTPS to encrypt connections and prevent eavesdropping. As a temporary workaround, restrict access to sensitive information until a patch is available. Ensure that all connections to the ABB eSOMS use encrypted protocols to protect cookie information.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-16

Related Identifiers

BDU:2023-03074

CVE-2019-19090

Affected Products

Abb Esoms

References · 7

• https://bdu.fstec.ru/vul/2023-03074 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19090 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19090 · Vendor Advisory
• https://t.me/cvenotify/2379 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://t.me/cibsecurity/10968 · Telegram Post