CVEvulnerability

CVE-2019-18998

7.1 HIGH Published 2020-02-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
Weaknesses
CWE-284, CWE-639

Description

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.

Affected configurations

• hitachienergy asset suite (>= 9.0.0 <= 9.3.0) • hitachienergy asset suite (>= 9.4 < 9.4.2.6) • hitachienergy asset suite (>= 9.5.0 < 9.5.3.2) • hitachienergy asset suite 9.6.0

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References