PT-2024-9237 · Abb · Abb Aspect Enterprise

Published 2024-12-05 · Updated 2024-12-05 · CVE-2024-6784

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ABB ASPECT Enterprise version 3.08.02 NEXUS Series version 3.08.02 MATRIX Series version 3.08.02

Description: The issue is related to insufficient validation of incoming requests, which can be exploited by a remote attacker to gain unauthorized access to resources and disclose protected information. This is a Server-Side Request Forgery vulnerability, providing a potential for access to unauthorized resources and unintended information disclosure.

Recommendations: For ABB ASPECT Enterprise version 3.08.02, consider disabling the vulnerable functionality until a patch is available. For NEXUS Series version 3.08.02, restrict access to unauthorized resources to minimize the risk of exploitation. For MATRIX Series version 3.08.02, avoid using the vulnerable API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-10925

CVE-2024-6784

Affected Products

Abb Aspect Enterprise

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-6784 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10925 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6784 · Vendor Advisory
• https://twitter.com/CVEnew/status/1864657060538794003 · Twitter Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://t.me/cvedetector/12080 · Telegram Post
• https://twitter.com/CveFindCom/status/1864649673933258884 · Twitter Post