PT-2023-5834 · Unknown · Asset Suite Eam

Published 2023-09-08 · Updated 2023-09-13 · CVE-2023-4816

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asset Suite EAM versions (affected versions not specified)

Description A vulnerability exists in the Equipment Tag Out authentication when configured with Single Sign-On (SSO) and password validation. This issue allows an authenticated user to perform an Equipment Tag Out holder action for another user by entering an arbitrary password in the holder action confirmation dialog box, which the system will then execute despite the incorrect password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-06520

CVE-2023-4816

Affected Products

Asset Suite Eam

References · 9

• https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4816 · Security Note
• https://bdu.fstec.ru/vul/2023-06520 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4816 · Vendor Advisory
• https://twitter.com/CVEnew/status/1701141780777841132 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1701183954936553939 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-269-02 · Note
• https://t.me/cibsecurity/70201 · Telegram Post
• https://t.me/cvenotify/57924 · Telegram Post