Summary
ABB heeft kwetsbaarheden verholpen in de ASPECT-productlijn, inclusief ASPECT-Enterprise, NEXUS Series en MATRIX Series tot versie 3.08.03.
Details
Interpretaties
De kwetsbaarheden omvatten onder andere Remote Code Execution, SQL-injectie, servlet-injectie, en verschillende vormen van bestandstoegang en -manipulatie. Deze kwetsbaarheden kunnen worden geëxploiteerd wanneer sessie-administratorcredentials zijn gecompromitteerd, wat kan leiden tot ongeautoriseerde toegang, controle over systemen, en ernstige gevolgen voor de integriteit en vertrouwelijkheid van gegevens. Aanvallers kunnen bijvoorbeeld willekeurige code uitvoeren, systeembronnen uitputten, gevoelige bestanden benaderen of zelfs systeembestanden verwijderen, wat kan resulteren in operationele verstoringen.
Oplossingen
ABB heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 14
-
Critical 9.1
Admin Authorized System File corruption
File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through …
-
Critical 9.1
Admin Authorized Port (iptables) manipulation (open/close/disable ports)
Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX…
-
Critical 9.0
Authenticated Escalation to guest to root
An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.…
-
Critical 9.0
Admin Authorized System File Deletion
System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: throug…
-
High 8.0
Authenticated Remote Code Execution
Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
High 8.0
Admin Authorized Remote Code Execution
Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
High 7.2
Authenticated SQL Injection
SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Ser…
-
High 7.2
Authenticated Servlet Command Injection
Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
High 7.2
Authenticated Relative Path Traversal
Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
High 7.2
Authenticated Absolute Path Traversal
Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
Medium 6.7
Admin Authorized File Upload and Execute PHP
File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
Medium 6.7
Admin Authorized File Upload
File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
-
Medium 5.5
Admin Authorized Exposure of file path, file size or file existence
Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: thro…
-
Medium 4.9
Authenticated Unchecked Loop Condition
An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference - cveprojectv5; nvd
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A0021&LanguageCode=en&DocumentPartId=pdf&Action=Launch