CVE-2019-19003 - ABB eSOMS: HTTPOnly flag not set

Back Back to CVE browser

MEDIUM

ABB eSOMS: HTTPOnly flag not set

Published Apr 2, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.78%

Description

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.

Affected products

Vendor ABB Product eSOMS Default
n/a
- Version
  4.0 to 6.0.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ABB

eSOMS

n/a

Version	Status	Constraints
4.0 to 6.0.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-16

CWE-79

Cross-site Scripting (XSS)

References (1)

https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch		x_refsource_CONFIRMVendor Advisory