A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.9 |
13 Sep 2023, 14:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf - Vendor Advisory | |
| First Time |
Hitachienergy asset Suite
Hitachienergy |
|
| CWE | CWE-287 | |
| CPE | cpe:2.3:a:hitachienergy:asset_suite:9.6.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
11 Sep 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-11 08:15
Updated : 2024-11-21 08:36
NVD link : CVE-2023-4816
Mitre link : CVE-2023-4816
CVE.ORG link : CVE-2023-4816
JSON object : View
Products Affected
hitachienergy
- asset_suite
CWE
CWE-287
Improper Authentication