PT-2021-2355 · Hitachi Abb Power Grids · Hitachi Abb Power Grids Ellipse Enterprise Asset Management

Published 2021-03-03 · Updated 2023-05-16 · CVE-2021-27416

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25

Description The issue arises from the lack of protection for the web page structure, allowing an attacker to exploit this weakness by tricking a user into clicking on a malicious link. This can lead to the compromise of confidential information or the takeover of the user's session. The vulnerability can be exploited by a remote attacker using cross-site scripting attacks.

Recommendations For versions prior to and including 9.0.25, update to a version later than 9.0.25 to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages or links to minimize the risk of exploitation. Avoid using links from untrusted sources, and ensure that users are cautious when clicking on links from unknown senders.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01593

CVE-2021-27416

Affected Products

Hitachi Abb Power Grids Ellipse Enterprise Asset Management

References · 9

• https://bdu.fstec.ru/vul/2021-01593 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27416 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27416 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://t.me/cvenotify/28126 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-21-061-01 · Note
• https://t.me/cvenotify/28120 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-061-01 · Note
• https://cybersecurity-help.cz/vulnerabilities/51181 · Note