CVEvulnerability

CVE-2019-19003

6.1 MEDIUM Published 2020-04-02 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2020-04-02
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected]): 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected]): 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses: CWE-16, CWE-79

Description

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.

Affected configurations

• hitachienergy esoms (>= 4.0 <= 6.0.2)

Weakness · not in database (1)

CWE-16

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References