CVE-2021-26845 eSOMS Report Function Vulnerability

What is CVE-2021-26845?

CVE-2021-26845 is a high-severity missing authorization vulnerability in n/a, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report is discovered. This issue affects: Hitachi ABB Power Grids eSOMS 6.0 versions prior to 6.0.4.2.2; 6.1 versions prior to 6.1.4; 6.3 versions prior to 6.3.

Weakness: CWE-863

Which versions are affected by CVE-2021-26845?

It affects 1 product.

Products include Hitachienergy Esoms.

How do I fix CVE-2021-26845?

No fix has been published for CVE-2021-26845 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-26845 being exploited?

There is no known exploitation of CVE-2021-26845 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-14805 Auth bypass in ABB eSOMS Critical 9.8
• CVE-2019-19094 ABB eSOMS: SQL injection vulnerability High 7.6
• CVE-2021-35527 Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application High 7.5
• CVE-2019-19000 eSOMS Cachecontrol (Pragma) HTTP Header Medium 6.5
• CVE-2019-19001 eSOMS X-FrameOption Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r64q-3fpg-c3hr.