ABB eSOMS 6.0.0/6.0.1/6.0.2 Password Storage password recoverable

Summaryinfo

A vulnerability, which was classified as problematic, was found in ABB eSOMS 6.0.0/6.0.1/6.0.2. This impacts an unknown function of the component Password Storage. The manipulation results in password recoverable. This vulnerability is known as CVE-2019-19096. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability was found in ABB eSOMS 6.0.0/6.0.1/6.0.2. It has been classified as problematic. Affected is some unknown functionality of the component Password Storage. The manipulation with an unknown input leads to a password recoverable vulnerability. CWE is classifying the issue as CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. This is going to have an impact on confidentiality. CVE summarizes:

The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality.

The weakness was published 04/02/2020 (Website). The advisory is shared for download at search.abb.com. This vulnerability is traded as CVE-2019-19096 since 11/18/2019. The attack needs to be approached locally. A authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-152689, VDB-152690, VDB-152691 and VDB-152692. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ABB

Name

• eSOMS

Version

• 6.0.0
• 6.0.1
• 6.0.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion