CVE-2023-2876 - Session cookie exposure for client side script

Back Back to CVE browser

MEDIUM

Session cookie exposure for client side script

Published Jun 13, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.

Affected products

Vendor ABB Product Rex640 Pcl1 Default
unaffected
- Version
  1.0;0
  Status
  affected
  Constraints
  <1.0.8
Vendor ABB Product Rex640 Pcl2 Default
unaffected
- Version
  1.0;0
  Status
  affected
  Constraints
  <1.1.4
Vendor ABB Product Rex640 Pcl3 Default
unaffected
- Version
  1.0;0
  Status
  affected
  Constraints
  <1.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ABB

Rex640 Pcl1

unaffected

Version	Status	Constraints
1.0;0	affected	<1.0.8

ABB

Rex640 Pcl2

unaffected

Version	Status	Constraints
1.0;0	affected	<1.1.4

ABB

Rex640 Pcl3

unaffected

Version	Status	Constraints
1.0;0	affected	<1.2.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1004

CWE-732

Incorrect Permission Assignment

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-34324		Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423&LanguageCode=en&DocumentPartId=&Action=Launch		Vendor Advisory