VulnerabilityModified
CVE-2019-18998
An attacker with knowledge of a resource's URL can access the resource directly.
HIGH 7.1EPSS 0.78%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-639
- Affected
- hitachienergy/asset suite
- Source
- cybersecurity@ch.abb.com
References
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-072-02Third Party Advisory, US Government Resource
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-072-02Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.