« Volver al listado

CVE-2019-18998

Estado: ModificadaAlta (7.1)—

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hitachienergy — Asset Suite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-18998",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@ch.abb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@ch.abb.com",
      "affectedData": [
        {
          "vendor": "ABB",
          "product": "Asset Suite",
          "versions": [
            {
              "status": "affected",
              "version": "9.0 to 9.3"
            },
            {
              "status": "affected",
              "version": "9.4 prior to 9.4.2.6"
            },
            {
              "status": "affected",
              "version": "9.5 prior to 9.5.3.2"
            },
            {
              "status": "affected",
              "version": "9.6.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-17T19:15:12.150",
  "references": [
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=Launch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@ch.abb.com"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cybersecurity@ch.abb.com"
    },
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=Launch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-072-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@ch.abb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly."
    },
    {
      "lang": "es",
      "value": "Un control de acceso insuficiente en la interfaz web de ABB Asset Suite versiones 9.0 hasta 9.3, versiones 9.4 anteriores a 9.4.2.6, versiones 9.5 anteriores a 9.5.3.2 y versión 9.6.0, permite el acceso completo a objetos referenciados directamente. Un atacante con conocimiento de la URL de un recurso puede acceder al recurso directamente."
    }
  ],
  "lastModified": "2026-06-17T02:25:57.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6554BA4-B349-425B-993E-0EA57752CE2A",
              "versionEndIncluding": "9.3.0",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7004DE5-75BC-46AA-82D8-D1EC0255BBB1",
              "versionEndExcluding": "9.4.2.6",
              "versionStartIncluding": "9.4"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9005FA0D-504F-4016-A9FD-6F8D83DD295D",
              "versionEndExcluding": "9.5.3.2",
              "versionStartIncluding": "9.5.0"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:asset_suite:9.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36DD2317-A06E-4514-B365-2B88F049B2C1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@ch.abb.com"
}