A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:36
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.9 |
| References | () https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf - Vendor Advisory |
13 Sep 2023, 14:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:hitachienergy:asset_suite:9.6.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:asset_suite:*:*:*:*:*:*:*:* |
|
| First Time |
Hitachienergy
Hitachienergy asset Suite |
|
| CWE | CWE-287 |
11 Sep 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-11 08:15
Updated : 2024-11-21 08:36
NVD link : CVE-2023-4816
Mitre link : CVE-2023-4816
CVE.ORG link : CVE-2023-4816
JSON object : View
Products Affected
hitachienergy
- asset_suite
CWE
CWE-287
Improper Authentication