CVE-2019-18998: Asset Suite Direct Object Reference Access
First published: Mon Feb 17 2020(Updated: )
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
Credit: cybersecurity@ch.abb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachienergy Asset Suite | >=9.0.0<=9.3.0 | |
| Hitachienergy Asset Suite | >=9.4<9.4.2.6 | |
| Hitachienergy Asset Suite | >=9.5.0<9.5.3.2 | |
| Hitachienergy Asset Suite | =9.6.0 |
Remedy
The vulnerability is corrected in the following product versions: Asset Suite 9.4.2.6 Asset Suite 9.5.3.2 Asset Suite 9.6.1
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-18998?
CVE-2019-18998 is a vulnerability that allows full access to directly referenced objects in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2, and 9.6.0.
What is the severity of CVE-2019-18998?
The severity of CVE-2019-18998 is rated as high, with a CVSS score of 7.1.
Which software versions are affected by CVE-2019-18998?
CVE-2019-18998 affects ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2, and 9.6.0.
How can an attacker exploit CVE-2019-18998?
An attacker with knowledge of a resource's URL can directly access the resource, enabling full access to directly referenced objects.
Are there any references for CVE-2019-18998?
Yes, you can find references for CVE-2019-18998 at the following links: [Reference 1](https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=Launch), [Reference 2](https://www.us-cert.gov/ics/advisories/icsa-20-072-02).
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/author
- agent/title
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/hitachienergy
- canonical/hitachienergy asset suite
- version/hitachienergy asset suite/9.0.0
- version/hitachienergy asset suite/9.3.0
- version/hitachienergy asset suite/9.4
- version/hitachienergy asset suite/9.5.0
- version/hitachienergy asset suite/9.6.0