PT-2023-9781 · Abb · Abb Rex640 Pcl2+2

Published 2023-06-13 · Updated 2023-06-26 · CVE-2023-2876

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ABB REX640 PCL1 versions 1.0;0 through 1.0.7 ABB REX640 PCL2 versions 1.0;0 through 1.1.3 ABB REX640 PCL3 versions 1.0;0 through 1.2.0

Description The issue is related to a Sensitive Cookie without the 'HttpOnly' flag, which allows an attacker to perform Cross-Site Scripting (XSS). This can lead to unauthorized access and manipulation of the system.

Recommendations For ABB REX640 PCL1 versions 1.0;0 through 1.0.7, update to version 1.0.8 or later. For ABB REX640 PCL2 versions 1.0;0 through 1.1.3, update to version 1.1.4 or later. For ABB REX640 PCL3 versions 1.0;0 through 1.2.0, update to version 1.2.1 or later. As a temporary workaround, consider restricting access to sensitive cookies to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-1004

Related Identifiers

BDU:2024-10621

CVE-2023-2876

Affected Products

Abb Rex640 Pcl1

Abb Rex640 Pcl2

Abb Rex640 Pcl3

References · 5

• https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2876 · Security Note
• https://bdu.fstec.ru/vul/2024-10621 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2876 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423&LanguageCode=en&DocumentPartId=&Action=Launch · Note