CVE-2019-19003 : Security Advisory and Response

ABB eSOMS: HTTPOnly flag not set

Understanding CVE-2019-19003

This CVE involves the absence of the HTTPOnly flag in ABB eSOMS versions 4.0 to 6.0.2, potentially leading to Cross Site Scripting vulnerabilities.

What is CVE-2019-19003?

The HTTPOnly flag is not enabled for ABB eSOMS versions 4.0 to 6.0.2, allowing JavaScript access to cookie contents, posing a risk of Cross Site Scripting.

The Impact of CVE-2019-19003

CVSS Base Score: 5.3 (Medium Severity)
Attack Vector: Network
Confidentiality Impact: Low
Integrity Impact: None
Privileges Required: None
This vulnerability could be exploited to execute malicious scripts on the user's browser.

Technical Details of CVE-2019-19003

Vulnerability Description

The absence of the HTTPOnly flag in ABB eSOMS versions 4.0 to 6.0.2 allows JavaScript to access cookie contents, potentially leading to Cross Site Scripting attacks.

Affected Systems and Versions

Affected Product: eSOMS
Vendor: ABB
Affected Versions: 4.0 to 6.0.2

Exploitation Mechanism

The vulnerability can be exploited by malicious actors to inject and execute scripts on the user's browser, compromising sensitive data.

Mitigation and Prevention

Immediate Steps to Take

Enable the HTTPOnly flag for cookies in ABB eSOMS versions 4.0 to 6.0.2.
Regularly monitor and audit cookie usage to detect any unauthorized access.

Long-Term Security Practices

Implement secure coding practices to prevent Cross Site Scripting vulnerabilities.
Conduct regular security assessments and penetration testing to identify and address potential weaknesses.

Patching and Updates

Apply patches or updates provided by ABB to address the HTTPOnly flag issue and enhance security measures.