github - ghsa-3r56-5r55-j5mh

GHSA-3R56-5R55-J5MH

Vulnerability from github – Published: 2024-12-02 09:39 – Updated: 2024-12-02 09:39

Details

An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions. B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.

Severity ?

8.4 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-10490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-02T09:15:04Z",
    "severity": "HIGH"
  },
  "details": "An \u201cAuthentication Bypass Using an Alternate Path or Channel\u201d vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.",
  "id": "GHSA-3r56-5r55-j5mh",
  "modified": "2024-12-02T09:39:12Z",
  "published": "2024-12-02T09:39:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10490"
    },
    {
      "type": "WEB",
      "url": "https://www.br-automation.com/fileadmin/SA22P014-90c4aa35.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2024-10490 (GCVE-0-2024-10490)

Vulnerability from cvelistv5 – Published: 2024-12-02 08:46 – Updated: 2024-12-02 22:11

Summary

Severity ?

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

ABB

References

URL

Tags

https://www.br-automation.com/fileadmin/SA22P014-…

Impacted products

Vendor

Product

Version

B&R Industrial Automation GmbH

B&R mapp Cockpit

Affected: 5.0;0 , < 6.0;0 (custom)

B&R Industrial Automation GmbH	B&R mapp View	Affected: 5.0 , < 6.0 (custom)
B&R Industrial Automation GmbH	B&R mapp Services	Affected: 5.0 , < 6.0 (custom)
B&R Industrial Automation GmbH	B&R mapp Motion	Affected: 5.0 , < 6.0 (custom)
B&R Industrial Automation GmbH	B&R mapp Vision	Affected: 5.0 , < 6.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10490",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-02T22:11:11.404146Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-02T22:11:21.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "B\u0026R mapp Cockpit",
          "vendor": "B\u0026R Industrial Automation GmbH",
          "versions": [
            {
              "lessThan": "6.0;0",
              "status": "affected",
              "version": "5.0;0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B\u0026R mapp View",
          "vendor": "B\u0026R Industrial Automation GmbH",
          "versions": [
            {
              "lessThan": "6.0",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B\u0026R mapp Services",
          "vendor": "B\u0026R Industrial Automation GmbH",
          "versions": [
            {
              "lessThan": "6.0",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B\u0026R mapp Motion",
          "vendor": "B\u0026R Industrial Automation GmbH",
          "versions": [
            {
              "lessThan": "6.0",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B\u0026R mapp Vision",
          "vendor": "B\u0026R Industrial Automation GmbH",
          "versions": [
            {
              "lessThan": "6.0",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-11-27T04:12:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An \u201cAuthentication Bypass Using an Alternate Path or Channel\u201d vulnerability in the OPC UA Server configuration required for B\u0026amp;R mapp Cockpit before 6.0, B\u0026amp;R mapp View before 6.0, B\u0026amp;R mapp Services before 6.0, B\u0026amp;R mapp Motion before 6.0 and B\u0026amp;R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\u003cbr\u003eB\u0026amp;R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.\u003cbr\u003e"
            }
          ],
          "value": "An \u201cAuthentication Bypass Using an Alternate Path or Channel\u201d vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-02T08:46:48.918Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://www.br-automation.com/fileadmin/SA22P014-90c4aa35.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authentication bypass flaw in several mapp components",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEnforce client device authentication in the configuration of the OPC UA server. Configure a proper \u201cSecurityPolicy\u201d for OPC UA Server (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://help.br-automation.com/#/en/4/communication/opcua/runtime/opcua_config_security.html\"\u003eAutomation Help\u003c/a\u003e) and select a \u201cCertificateStore configuration\u201d which has \u201cValidate SSL communication partner\u201d set to \u201con\u201d (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://help.br-automation.com/#/en/4/access_and_security%2Fssl%2Fssl_configuration.html\"\u003eAutomation Help\u003c/a\u003e).\u003c/p\u003e\u003cp\u003eLimit access to the OPC UA Server (default 4840/tcp) to IP addresses or IP subnets which are running instances of impacted mapp components and legitime OPC UA clients using the B\u0026amp;R Automation Runtime host-based firewall. Ensure only trusted personal is able to access devices with the specified IP (range) and enforce strict authentication on these devices.\u003c/p\u003e\u003cp\u003ePlease be aware that B\u0026amp;R Automation Runtime and its services (like mapp components) are not intended to be directly connected to the internet at any time. Customers are advised to use the host-based firewall as well as an external control network firewall to limit access to each service running at B\u0026amp;R Automation Runtime. Additionally, consider granting access from the outside of the control network only to specific timeframes (e.g. for maintenance).\u003c/p\u003e\u003cp\u003e\u003cb\u003emapp View\u003c/b\u003e\u003c/p\u003e\u003cp\u003eFor customers only using the OPC UA Server for their mapp View Visualization, block all incoming traffic to the OPC UA Server (default port 4840/tcp) using the B\u0026amp;R Automation Runtime host-based firewall. Blocking external traffic on the OPC UA Server has no impact on the functionality of mapp View.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Enforce client device authentication in the configuration of the OPC UA server. Configure a proper \u201cSecurityPolicy\u201d for OPC UA Server ( Automation Help https://help.br-automation.com/#/en/4/communication/opcua/runtime/opcua_config_security.html ) and select a \u201cCertificateStore configuration\u201d which has \u201cValidate SSL communication partner\u201d set to \u201con\u201d ( Automation Help https://help.br-automation.com/#/en/4/access_and_security%2Fssl%2Fssl_configuration.html ).\n\nLimit access to the OPC UA Server (default 4840/tcp) to IP addresses or IP subnets which are running instances of impacted mapp components and legitime OPC UA clients using the B\u0026R Automation Runtime host-based firewall. Ensure only trusted personal is able to access devices with the specified IP (range) and enforce strict authentication on these devices.\n\nPlease be aware that B\u0026R Automation Runtime and its services (like mapp components) are not intended to be directly connected to the internet at any time. Customers are advised to use the host-based firewall as well as an external control network firewall to limit access to each service running at B\u0026R Automation Runtime. Additionally, consider granting access from the outside of the control network only to specific timeframes (e.g. for maintenance).\n\nmapp View\n\nFor customers only using the OPC UA Server for their mapp View Visualization, block all incoming traffic to the OPC UA Server (default port 4840/tcp) using the B\u0026R Automation Runtime host-based firewall. Blocking external traffic on the OPC UA Server has no impact on the functionality of mapp View."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2024-10490",
    "datePublished": "2024-12-02T08:46:44.044Z",
    "dateReserved": "2024-10-29T11:13:34.960Z",
    "dateUpdated": "2024-12-02T22:11:21.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3R56-5R55-J5MH

CVE-2024-10490 (GCVE-0-2024-10490)

Tags

Sightings

Nomenclature