Search criteria
3 vulnerabilities found for Asset Suite by ABB
VAR-202002-0493
Vulnerability from variot - Updated: 2023-12-18 13:47Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly. ABB Asset Suite Exists in a user-controlled key authentication evasion vulnerability.Information may be obtained and tampered with. ABB Asset Suite is a set of enterprise asset management solutions mainly used in the power generation industry by Swiss ABB company. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to obtain sensitive information on the website. The following products and versions are affected: ABB Asset Suite from version 9.0 to version 9.3, version 9.4 before 9.4.2.6, version 9.5 before 9.5.3.2, version 9.6.0
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202002-0493",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "asset suite",
"scope": "eq",
"trust": 1.4,
"vendor": "abb",
"version": "9.6.0"
},
{
"model": "asset suite",
"scope": "lte",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.3.0"
},
{
"model": "asset suite",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.6.0"
},
{
"model": "asset suite",
"scope": "lt",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.5.3.2"
},
{
"model": "asset suite",
"scope": "gte",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.4"
},
{
"model": "asset suite",
"scope": "lt",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.4.2.6"
},
{
"model": "asset suite",
"scope": "gte",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.0.0"
},
{
"model": "asset suite",
"scope": "gte",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "9.5.0"
},
{
"model": "asset suite",
"scope": "eq",
"trust": 0.8,
"vendor": "abb",
"version": "9.0 \u304b\u3089 9.3"
},
{
"model": "asset suite",
"scope": "eq",
"trust": 0.8,
"vendor": "abb",
"version": "9.4 \u4ee5\u4e0a 9.4.2.6"
},
{
"model": "asset suite",
"scope": "eq",
"trust": 0.8,
"vendor": "abb",
"version": "9.5 \u4ee5\u4e0a 9.5.3.2"
},
{
"model": "asset suite",
"scope": "gte",
"trust": 0.6,
"vendor": "abb",
"version": "9.0,\u003c=9.3"
},
{
"model": "asset suite",
"scope": "eq",
"trust": 0.6,
"vendor": "abb",
"version": "9.4,\u003c9.4.2.6"
},
{
"model": "asset suite",
"scope": "eq",
"trust": 0.6,
"vendor": "abb",
"version": "9.5,\u003c9.5.3.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "asset suite",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "asset suite",
"version": "9.6.0"
}
],
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:hitachienergy:asset_suite:9.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.5.3.2",
"versionStartIncluding": "9.5.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.4.2.6",
"versionStartIncluding": "9.4",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.3.0",
"versionStartIncluding": "9.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-18998"
}
]
},
"cve": "CVE-2019-18998",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2019-014607",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2020-10131",
"impactScore": 7.8,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "1076aff9-d046-423b-9962-e26fd72b94cc",
"impactScore": 7.8,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "VHN-151400",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2019-014607",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-18998",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "cybersecurity@ch.abb.com",
"id": "CVE-2019-18998",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2019-014607",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2020-10131",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202002-866",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-151400",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "VULHUB",
"id": "VHN-151400"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly. ABB Asset Suite Exists in a user-controlled key authentication evasion vulnerability.Information may be obtained and tampered with. ABB Asset Suite is a set of enterprise asset management solutions mainly used in the power generation industry by Swiss ABB company. The vulnerability stems from a network system or product that did not properly restrict access to resources from unauthorized roles. An attacker could use this vulnerability to obtain sensitive information on the website. The following products and versions are affected: ABB Asset Suite from version 9.0 to version 9.3, version 9.4 before 9.4.2.6, version 9.5 before 9.5.3.2, version 9.6.0",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "VULHUB",
"id": "VHN-151400"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-18998",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSA-20-072-02",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2020-10131",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2020.0930",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "47150",
"trust": 0.6
},
{
"db": "IVD",
"id": "1076AFF9-D046-423B-9962-E26FD72B94CC",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-151400",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "VULHUB",
"id": "VHN-151400"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"id": "VAR-202002-0493",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "VULHUB",
"id": "VHN-151400"
}
],
"trust": 1.5666666999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
}
]
},
"last_update_date": "2023-12-18T13:47:39.721000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Asset Suite Direct Object Reference Vulnerability",
"trust": 0.8,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk107492a9962\u0026languagecode=en\u0026documentpartid=\u0026action=launch"
},
{
"title": "Patch for ABB Asset Suite Access Control Error Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/201555"
},
{
"title": "ABB Asset Suite Fixes for access control error vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=110228"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-639",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-151400"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
},
{
"trust": 2.2,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk107492a9962\u0026languagecode=en\u0026documentpartid=\u0026action=launch"
},
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-18998"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-18998"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/47150"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.0930/"
},
{
"trust": 0.1,
"url": "https://search.abb.com/library/download.aspx?documentid=9akk107492a9962\u0026amp;languagecode=en\u0026amp;documentpartid=\u0026amp;action=launch"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "VULHUB",
"id": "VHN-151400"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "VULHUB",
"id": "VHN-151400"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-17T00:00:00",
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"date": "2020-02-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"date": "2020-02-17T00:00:00",
"db": "VULHUB",
"id": "VHN-151400"
},
{
"date": "2020-03-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"date": "2020-02-17T19:15:12.150000",
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"date": "2020-02-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-02-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"date": "2020-03-12T00:00:00",
"db": "VULHUB",
"id": "VHN-151400"
},
{
"date": "2020-03-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-014607"
},
{
"date": "2023-05-16T20:06:09.550000",
"db": "NVD",
"id": "CVE-2019-18998"
},
{
"date": "2020-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ABB Asset Suite Access Control Error Vulnerability",
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNVD",
"id": "CNVD-2020-10131"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Access control error",
"sources": [
{
"db": "IVD",
"id": "1076aff9-d046-423b-9962-e26fd72b94cc"
},
{
"db": "CNNVD",
"id": "CNNVD-202002-866"
}
],
"trust": 0.8
}
}
CVE-2019-18998 (GCVE-0-2019-18998)
Vulnerability from cvelistv5 – Published: 2020-02-17 18:40 – Updated: 2024-08-05 02:02
VLAI?
Title
Asset Suite Direct Object Reference Access
Summary
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
Severity ?
7.1 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ABB | Asset Suite |
Affected:
9.0 to 9.3
Affected: 9.4 prior to 9.4.2.6 Affected: 9.5 prior to 9.5.3.2 Affected: 9.6.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:02:39.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Asset Suite",
"vendor": "ABB",
"versions": [
{
"status": "affected",
"version": "9.0 to 9.3"
},
{
"status": "affected",
"version": "9.4 prior to 9.4.2.6"
},
{
"status": "affected",
"version": "9.5 prior to 9.5.3.2"
},
{
"status": "affected",
"version": "9.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-12T22:28:21",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is corrected in the following product versions:\nAsset Suite 9.4.2.6\nAsset Suite 9.5.3.2\nAsset Suite 9.6.1"
}
],
"source": {
"advisory": "ABBVU-PGGA-2019013",
"discovery": "UNKNOWN"
},
"title": "Asset Suite Direct Object Reference Access",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2019-18998",
"STATE": "PUBLIC",
"TITLE": "Asset Suite Direct Object Reference Access"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Asset Suite",
"version": {
"version_data": [
{
"version_value": "9.0 to 9.3"
},
{
"version_value": "9.4 prior to 9.4.2.6"
},
{
"version_value": "9.5 prior to 9.5.3.2"
},
{
"version_value": "9.6.0"
}
]
}
}
]
},
"vendor_name": "ABB"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
"refsource": "CONFIRM",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "The vulnerability is corrected in the following product versions:\nAsset Suite 9.4.2.6\nAsset Suite 9.5.3.2\nAsset Suite 9.6.1"
}
],
"source": {
"advisory": "ABBVU-PGGA-2019013",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2019-18998",
"datePublished": "2020-02-17T18:40:38",
"dateReserved": "2019-11-15T00:00:00",
"dateUpdated": "2024-08-05T02:02:39.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-18998 (GCVE-0-2019-18998)
Vulnerability from nvd – Published: 2020-02-17 18:40 – Updated: 2024-08-05 02:02
VLAI?
Title
Asset Suite Direct Object Reference Access
Summary
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
Severity ?
7.1 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ABB | Asset Suite |
Affected:
9.0 to 9.3
Affected: 9.4 prior to 9.4.2.6 Affected: 9.5 prior to 9.5.3.2 Affected: 9.6.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:02:39.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Asset Suite",
"vendor": "ABB",
"versions": [
{
"status": "affected",
"version": "9.0 to 9.3"
},
{
"status": "affected",
"version": "9.4 prior to 9.4.2.6"
},
{
"status": "affected",
"version": "9.5 prior to 9.5.3.2"
},
{
"status": "affected",
"version": "9.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-12T22:28:21",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is corrected in the following product versions:\nAsset Suite 9.4.2.6\nAsset Suite 9.5.3.2\nAsset Suite 9.6.1"
}
],
"source": {
"advisory": "ABBVU-PGGA-2019013",
"discovery": "UNKNOWN"
},
"title": "Asset Suite Direct Object Reference Access",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2019-18998",
"STATE": "PUBLIC",
"TITLE": "Asset Suite Direct Object Reference Access"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Asset Suite",
"version": {
"version_data": [
{
"version_value": "9.0 to 9.3"
},
{
"version_value": "9.4 prior to 9.4.2.6"
},
{
"version_value": "9.5 prior to 9.5.3.2"
},
{
"version_value": "9.6.0"
}
]
}
}
]
},
"vendor_name": "ABB"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
"refsource": "CONFIRM",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "The vulnerability is corrected in the following product versions:\nAsset Suite 9.4.2.6\nAsset Suite 9.5.3.2\nAsset Suite 9.6.1"
}
],
"source": {
"advisory": "ABBVU-PGGA-2019013",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2019-18998",
"datePublished": "2020-02-17T18:40:38",
"dateReserved": "2019-11-15T00:00:00",
"dateUpdated": "2024-08-05T02:02:39.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}