Search
Find a vulnerability
Search criteria
1 vulnerability found for Asset Suite by ABB
CVE-2019-18998 (GCVE-0-2019-18998)
Vulnerability from cvelistv5 – Published: 2020-02-17 18:40 – Updated: 2024-08-05 02:02
VLAI
EPSS
VEX
Title
Asset Suite Direct Object Reference Access
Summary
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
Severity
7.1 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
ABB
CNA
References
2 references
| URL | Tags |
|---|---|
| https://search.abb.com/library/Download.aspx?Docu… | x_refsource_CONFIRM |
| https://www.us-cert.gov/ics/advisories/icsa-20-072-02 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ABB | Asset Suite |
Affected:
9.0 to 9.3
Affected: 9.4 prior to 9.4.2.6 Affected: 9.5 prior to 9.5.3.2 Affected: 9.6.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:02:39.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Asset Suite",
"vendor": "ABB",
"versions": [
{
"status": "affected",
"version": "9.0 to 9.3"
},
{
"status": "affected",
"version": "9.4 prior to 9.4.2.6"
},
{
"status": "affected",
"version": "9.5 prior to 9.5.3.2"
},
{
"status": "affected",
"version": "9.6.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-12T22:28:21.000Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability is corrected in the following product versions:\nAsset Suite 9.4.2.6\nAsset Suite 9.5.3.2\nAsset Suite 9.6.1"
}
],
"source": {
"advisory": "ABBVU-PGGA-2019013",
"discovery": "UNKNOWN"
},
"title": "Asset Suite Direct Object Reference Access",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2019-18998",
"STATE": "PUBLIC",
"TITLE": "Asset Suite Direct Object Reference Access"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Asset Suite",
"version": {
"version_data": [
{
"version_value": "9.0 to 9.3"
},
{
"version_value": "9.4 prior to 9.4.2.6"
},
{
"version_value": "9.5 prior to 9.5.3.2"
},
{
"version_value": "9.6.0"
}
]
}
}
]
},
"vendor_name": "ABB"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource\u0027s URL can access the resource directly."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch",
"refsource": "CONFIRM",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "The vulnerability is corrected in the following product versions:\nAsset Suite 9.4.2.6\nAsset Suite 9.5.3.2\nAsset Suite 9.6.1"
}
],
"source": {
"advisory": "ABBVU-PGGA-2019013",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2019-18998",
"datePublished": "2020-02-17T18:40:38.000Z",
"dateReserved": "2019-11-15T00:00:00.000Z",
"dateUpdated": "2024-08-05T02:02:39.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}