CVEvulnerability

CVE-2019-19002

5.4 MEDIUM Published 2020-04-02 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2020-04-02
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS 3.1 ([email protected]): 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected]): 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses: CWE-16, CWE-79

Description

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.

Affected configurations

• hitachienergy esoms (>= 4.0 <= 6.0.2)

Weakness · not in database (1)

CWE-16

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References