CVE-2018-14805 - ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are present

Back Back to CVE browser

CRITICAL

ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are present

Published Aug 29, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 4.81%

Description

ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are present. Both conditions are required to exploit this vulnerability.

Affected products

Vendor Ics-Cert Product ABB eSOMS Default
n/a
- Version
  Version 6.0.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ics-Cert

ABB eSOMS

n/a

Version	Status	Constraints
Version 6.0.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

http://www.securityfocus.com/bid/105169
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-240-04
x_refsource_MISCThird Party AdvisoryUS Government Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107046A5821&LanguageCode=en&DocumentPartId=&Action=Launch
x_refsource_CONFIRMMitigationVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/105169		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-240-04		x_refsource_MISCThird Party AdvisoryUS Government Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107046A5821&LanguageCode=en&DocumentPartId=&Action=Launch		x_refsource_CONFIRMMitigationVendor Advisory