PT-2022-5005 · Hitachi Energy · Hitachi Energy Msm

Published 2022-07-25 · Updated 2023-04-19 · CVE-2021-40335

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Energy MSM versions V2.2 and prior

Description A vulnerability exists in the HTTP web interface where it does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This causes a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker could perform harmful commands on MSM through its web server interface by making an MSM user who has already established a session click a forged link to the MSM web interface.

Recommendations For Hitachi Energy MSM versions V2.2 and prior, consider implementing additional validation mechanisms for requests to prevent CSRF attacks, such as verifying the origin of requests or using tokens to ensure requests are intentional and legitimate. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2022-06218

CVE-2021-40335

Affected Products

Hitachi Energy Msm

References · 6

• https://bdu.fstec.ru/vul/2022-06218 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40335 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40335 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://t.me/cibsecurity/46910 · Telegram Post