CVE-2023-2876 Session cookie exposure for client side script
Attackers can steal session cookies via XSS due to missing HttpOnly flags, potentially leading to account takeover on ABB REX640 relays.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-2876?
CVE-2023-2876 is a low-severity cross-site scripting vulnerability in ABB REX640 PCL1, published on 13 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.
Which versions are affected by CVE-2023-2876?
It affects 3 products.
Products include Abb Rex640 Pcl1 Firmware, Abb Rex640 Pcl2 Firmware, Abb Rex640 Pcl3 Firmware.
How do I fix CVE-2023-2876?
No fix has been published for CVE-2023-2876 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-2876 being exploited?
There is no known exploitation of CVE-2023-2876 in the wild and no public exploit code.
Other vulnerabilities in ABB REX640 PCL1
Sources
Also known as GHSA-xxww-73xw-x3fj.