VulnerabilityModified

CVE-2019-19090

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header.

LOW 3.5EPSS 0.52%

Does this matter?

Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.

Description

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping.

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-16, CWE-311
Affected: hitachienergy/esoms
Source: cybersecurity@ch.abb.com

References

https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.