CVE-2023-1258

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/173610/ABB-FlowX-4.00-Information-Disclosure.html	Exploit Third Party Advisory VDB Entry
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A9754&LanguageCode=en&DocumentPartId=&Action=Launch	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:abb:flow-x\/m_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/m:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:abb:flow-x\/c_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/c:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:abb:flow-x\/k_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/k:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:abb:flow-x\/s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:abb:flow-x\/p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/p:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:abb:flow-x_r_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x_r:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:abb:flow-x\/t_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/t:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:abb:flow-x\/web_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:flow-x\/web:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-03-31 08:15

Updated : 2023-08-02 17:05

NVD link : CVE-2023-1258

Mitre link : CVE-2023-1258

CVE.ORG link : CVE-2023-1258

JSON object : View

Products Affected

abb

flow-x\/k_firmware
flow-x\/p
flow-x\/web
flow-x\/m
flow-x\/k
flow-x\/m_firmware
flow-x\/c_firmware
flow-x_r
flow-x\/web_firmware
flow-x\/p_firmware
flow-x\/s
flow-x\/s_firmware
flow-x_r_firmware
flow-x\/t_firmware
flow-x\/t
flow-x\/c

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-1258", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cybersecurity@ch.abb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-03-31T08:15:06.397", "references": [{"url": "http://packetstormsecurity.com/files/173610/ABB-FlowX-4.00-Information-Disclosure.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cybersecurity@ch.abb.com"}, {"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A9754&LanguageCode=en&DocumentPartId=&Action=Launch", "tags": ["Vendor Advisory"], "source": "cybersecurity@ch.abb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cybersecurity@ch.abb.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.\n\n"}], "lastModified": "2023-08-02T17:05:07.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/m_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DCEC272-343C-4D88-9ED6-A3D5DC25A2FB", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/m:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "61233B04-F1F2-4C5B-A260-460D30CFC162"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "406419A5-33DC-489D-A3DC-2736C8C788B3", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B4F273C0-E67E-4F69-8F2C-D3F498755DDA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/k_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A769914-724B-4D91-BF2C-A646EA0FF1A8", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/k:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2824256-84EE-45A6-9794-10F4AA580D11"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/s_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C079FE6-59A6-4220-B7FE-7AA47244C39C", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "15B144BE-2159-48A9-A097-599BDE51E8B2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/p_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "794E908F-D650-4E92-898E-A4FCAD199744", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6B7823F0-C4B5-4A8F-8429-58CE14E46CE9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x_r_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C75BB6AE-9113-43AA-AAAC-5D0CE4160F69", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x_r:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5E5A008E-37C8-46A4-AD6C-3E8BCD555B79"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/t_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C3CD012-F79D-4D51-85B2-90F10C11E5BE", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C96DF884-7DF2-46AB-B5C5-6BB301B030C3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:abb:flow-x\\/web_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1845A152-6B8A-4B12-82BB-0CBE39D8738E", "versionEndIncluding": "3.2.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:abb:flow-x\\/web:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "90F9782F-E7B8-45FC-8CBD-316ED3A7D37E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@ch.abb.com"}