For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping.
Para ABB eSOMS versiones 4.0 hasta 6.0.2, el Secure Flag no se establece en el encabezado de respuesta HTTP. Las conexiones no cifradas pueden acceder a la información de la cookie, haciéndolas así susceptibles a espionaje.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:M/Au:S/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | SINGLE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-16
|
| [email protected] | Primary |
en
CWE-311
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| hitachienergy | esoms | * | <built-in method update of dict object at 0x72a99a642940> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:hitachienergy:esoms:*:*:*:*:*:*:*:* |