PT-2021-2366 · Hitachi Abb Power Grids · Ellipse Enterprise Asset Management

Published 2021-03-03 · Updated 2023-05-16 · CVE-2021-27414

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25

Description The issue exists due to inadequate protection of the web page structure, allowing a remote attacker to exploit it and potentially tamper with page content. An attacker could trick a user into visiting a malicious website posing as a login page for the Ellipse application, thereby gathering authentication credentials.

Recommendations For versions prior to and including 9.0.25, update to a version later than 9.0.25 to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable login pages until a patch is available. Avoid using unverified or suspicious links to access the Ellipse application, and instead, use trusted bookmarks or navigate to the application through official channels.

Fix

XSS

Clickjacking

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-79

CWE-1021

CWE-451

Related Identifiers

BDU:2021-01606

CVE-2021-27414

Affected Products

Ellipse Enterprise Asset Management

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-27414 · Security Note
• https://bdu.fstec.ru/vul/2021-01606 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27414 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-21-061-01 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-061-01 · Note
• https://cybersecurity-help.cz/vulnerabilities/51182 · Note
• https://t.me/cvenotify/28114 · Telegram Post