PT-2024-9184 · Abb · Matrix Series+2

Published 2024-12-05 · Updated 2024-12-05 · CVE-2024-51541

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise version 3.08.02 NEXUS Series version 3.08.02 MATRIX Series version 3.08.02

Description: The issue is related to Local File Inclusion vulnerabilities, which allow access to sensitive system information. This is due to incorrect management of file names for PHP functions include or require. Exploitation of the issue may allow a remote attacker to gain access to confidential information.

Recommendations: For ABB ASPECT - Enterprise version 3.08.02, consider disabling the include and require PHP functions until a patch is available. For NEXUS Series version 3.08.02, restrict access to sensitive system information to minimize the risk of exploitation. For MATRIX Series version 3.08.02, avoid using the include and require PHP functions in sensitive areas of the system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

BDU:2024-10871

CVE-2024-51541

Affected Products

Abb Aspect

Matrix Series

Nexus Series

References · 9

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51541 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51541 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10871 · Security Note
• https://t.me/cvedetector/12090 · Telegram Post
• https://twitter.com/CVEnew/status/1864657046559227994 · Twitter Post
• https://t.me/latest_high_impact_cve/1609 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://t.me/cvenotify/103106 · Telegram Post