VAR-201712-0121
Vulnerability from variot - Updated: 2023-12-18 12:44An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by sniffing local network traffic, allowing the discovery of authentication credentials. ABB Ellipse Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Ellipse is an EAM software application for asset-intensive industries. ABB Ellipse has an information disclosure vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201712-0121",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ellipse",
"scope": "lte",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "8.9.0"
},
{
"model": "ellipse",
"scope": "gte",
"trust": 1.0,
"vendor": "hitachienergy",
"version": "8.3.0"
},
{
"model": "ellipse",
"scope": "gte",
"trust": 0.8,
"vendor": "abb",
"version": "8.3\u003c=8.9"
},
{
"model": "ellipse",
"scope": null,
"trust": 0.8,
"vendor": "abb",
"version": null
},
{
"model": "ellipse select",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "0"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.9"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.8"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.7"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.6"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.5"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.4"
},
{
"model": "ellipse",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "8.3"
},
{
"model": "ellipse release",
"scope": "ne",
"trust": 0.3,
"vendor": "abb",
"version": "8.9.67"
},
{
"model": "ellipse release",
"scope": "ne",
"trust": 0.3,
"vendor": "abb",
"version": "8.8.127"
},
{
"model": "ellipse release",
"scope": "ne",
"trust": 0.3,
"vendor": "abb",
"version": "8.7.187"
},
{
"model": "ellipse release",
"scope": "ne",
"trust": 0.3,
"vendor": "abb",
"version": "8.6.215"
},
{
"model": "ellipse release",
"scope": "ne",
"trust": 0.3,
"vendor": "abb",
"version": "8.5.267"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "BID",
"id": "102224"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "NVD",
"id": "CVE-2017-16731"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:hitachienergy:ellipse:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.9.0",
"versionStartIncluding": "8.3.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-16731"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ABB",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
],
"trust": 0.6
},
"cve": "CVE-2017-16731",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 2.9,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-16731",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2017-37702",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-107683",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-16731",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-16731",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-37702",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201712-746",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-107683",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "VULHUB",
"id": "VHN-107683"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by sniffing local network traffic, allowing the discovery of authentication credentials. ABB Ellipse Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Ellipse is an EAM software application for asset-intensive industries. ABB Ellipse has an information disclosure vulnerability. \nAn attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "BID",
"id": "102224"
},
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-107683"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-16731",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-17-353-01",
"trust": 3.4
},
{
"db": "BID",
"id": "102224",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201712-746",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-37702",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E01D40-39AB-11E9-934F-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-107683",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "VULHUB",
"id": "VHN-107683"
},
{
"db": "BID",
"id": "102224"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"id": "VAR-201712-0121",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "VULHUB",
"id": "VHN-107683"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
}
]
},
"last_update_date": "2023-12-18T12:44:19.087000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://new.abb.com/"
},
{
"title": "ABB Ellipse information leaking hole patch patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/111305"
},
{
"title": "ABB Ellipse Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=77238"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-522",
"trust": 1.1
},
{
"problemtype": "CWE-255",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-107683"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "NVD",
"id": "CVE-2017-16731"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-353-01"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-16731"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-16731"
},
{
"trust": 0.6,
"url": "https://www.securityfocus.com/bid/102224"
},
{
"trust": 0.3,
"url": "http://www.abb.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "VULHUB",
"id": "VHN-107683"
},
{
"db": "BID",
"id": "102224"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"db": "VULHUB",
"id": "VHN-107683"
},
{
"db": "BID",
"id": "102224"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-12-21T00:00:00",
"db": "IVD",
"id": "e2e01d40-39ab-11e9-934f-000c29342cb1"
},
{
"date": "2017-12-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"date": "2017-12-20T00:00:00",
"db": "VULHUB",
"id": "VHN-107683"
},
{
"date": "2017-12-19T00:00:00",
"db": "BID",
"id": "102224"
},
{
"date": "2018-01-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"date": "2017-12-20T19:29:00.287000",
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"date": "2017-12-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-12-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-37702"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-107683"
},
{
"date": "2017-12-19T00:00:00",
"db": "BID",
"id": "102224"
},
{
"date": "2018-01-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-011780"
},
{
"date": "2023-05-16T20:10:13.340000",
"db": "NVD",
"id": "CVE-2017-16731"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ABB Ellipse Vulnerabilities related to certificate and password management",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-011780"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201712-746"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…